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Java-based data validation . Time-saving wizards include the Security 
Wizard, which easily manages OS and database log -in activity. 

PRICE: $2995 

COMPANY NAME: Hewlett-Packard Software Solutions Organization (534 889) 
SPECIAL FEATURE: Screen Layouts Charts 

DESCRIPTORS: CGI; Code Generators; HTML; Internet Utilities; Java; Program 

Development 
REVISION DATE: 20020730 
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00100162 DOCUMENT TYPE: Review 

PRODUCT NAMES: Microsoft Active Directory Services Interface (ADSI) 
(654175); LDAP 2 . 0 (837831); Novell Directory Services (NDS) (460354 

TITLE: Microsoft Activates Directory Development With LDAP APIs 

AUTHOR: Mendel, Brett 

SOURCE: LAN Times, vl4 n4 pll(l) Feb 17, 1997 

ISSN: 1040-5917 - - - — 

HOMEPAGE: http://www.lantiraes.com 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

Microsoft's Active Directory , which will be part of Microsoft's Microsoft 

Windows NT 5.0 operating system upgrade, includes support for 
Netscape's Lightweight Directory Access Protocol (LDAP); LDAP could make 
directory services a commodity. Microsoft is making available application 

programming interfaces (APIs) that provide developers with access to 
Active Directory or any other OS directory supporting LDAP. Novell, 
however, recommends that its NDS be used because LDAP 2.0 omits strong 
authentication features. Microsoft's software tools are expected to 
streamline tasks required to write applications that comply with LDAP, 
which provides a standardized way to gain access to application- and OS 
-specific directories . LDAP is being widely adopted by NOS vendors, which 
is advantageous for developers because LDAP may eliminate the need to write 
multiple versions of the same application to support many proprietary 
directories . Microsoft says that the intricacies of LDAP ' s API are 
disheartening to developers; it is rough code and hard to use. In contrast, 
ADSI (Active Directory Service Interface) is easier to work with, 
language-neutral, and LDAP-compliant . It can be used with Visual Basic, 
C++, Sun Microsystems Java, Perl, and other environments, says a product 
manager for Windows NT Server for Microsoft. 

COMPANY NAME: Microsoft Corp (112127); Vendor Independent (999999); 

Novell Inc (344893) 
SPECIAL FEATURE: Charts 

DESCRIPTORS: Communications Protocols; Computer Resource Management; IBM 
PC & Compatibles; Internetworking; Network Administration; Network 
Directories ; Network Software; Windows NT /2000 

REVISION DATE: 20020630 
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00097015 DOCUMENT TYPE: Review 

PRODUCT NAMES: AlertPage Enterprise (615005) ; NetWare Early Warning- 
System (317012) / NetWare Console Commander (429198) ; Seagate Server 
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27/5/1 (Item 1 from file: 202) 

DIALOG (R) File 202: Info. Sci . & Tech. Abs . 
(c) 2003, EBSCO Publishing. All rts. reserv. 

2602357 

Manitoba software industry: catalogue of capabilities. 

Book Title: Report No: MIC-90-00452/HCW 

Corporate Source: INFOTECH Manitoba, Winnipeg, Manitoba 
(106 pages) 

Publication Date: 1989 
Language: English 
Document Type: Book Chapter 
Record Type: Abstract 
Journal Announcement: 2 600 

This is a listing of companies marketing software. Information was 
gathered through a survey which located over 75 companies marketing 
software products in electronics engineering, farm management, computer 
graphics, educational courseware, artificial intelligence, data base 
management, business administration, health, and applications development 
tools and communications. Companies are listed alphabetically by category, 
and information is given on hardware compatibility, operating systems , 
method of distribution, list of agents, and products. 

Descriptors: Canada; Catalogs; Computer programs ; Directories 
Classification Codes and Description: 4.06 (Directories); 3.08 (Copying, 

Printing); 6.05 (Physical Sciences and Engineering) 
Main Heading: Information Recognition and Description; Information 

Generation and Promulgation; Information Systems and Applications 



27/5/2 (Item 2 from file: 202) 

DIALOG (R) File 202: Info. Sci. & Tech. Abs. 
(c) 2003, EBSCO Publishing. All rts. reserv. 

1302106 

A directory of computer software applications-minicomputer and 

microcomputers . 

Book Title: Report For 1964 To August 1977. 1977 October. National 

Technical Information Service, Springfield, Virginia. 90 P. Ntis: Pb-272 

972/lga; He (ell), Mf (ell). 

Author (s): Grooms, David W 

Publication Date: 1977 

Language: English 

Document Type: Book Chapter 

Record Type: Abstract 

Journal Announcement: 1300 

The computer programs or the computer program documentations 
cited in this directory has been developed to satisfy 
minicomputer/microcomputer systems needs as well as 

minicomputer/microcomputer applications needs. Included in the applications 
area in mini-microcomputer applications needs. Medicine, electronics 
design, chemistry and chemical engineering, physics, pattern ^recognition , 
computer graphics, energy, environmental studies and others. 
Minicomputer/microcomputer systems software cited in the directory 
includes compilers, operating systems , translators and cross 
assemblers. Also cited in mini-microcomputer software used in computer 
networks and communications networks. 

Classification Codes and Description: 5.02 (Computer Systems General) 
Main Heading: Information Processing and Control 



27/5/3 (Item 1 from file: 2) 

DIALOG (R) File 2 : INSPEC 

(c) 2003 Institution of Electrical Engineers. All rts. reserv. 



4909627 INSPEC Abstract Number: C9505-6180-001 

Title: Basic design of SHOSHI operating system that supports handwriting 
interfaces 

Author(s): Hayakawa, E.; Namiki, M. ; Takahashi, N . 

Author Affiliation: Dept. of Comput . Sci . , Tokyo Univ. of Agric. & 
Technol., Japan 

Journal: Transactions of the Information Processing Society of Japan 
vol.35, no. 12 p. 2590-601 

Publication Date: Dec. 1994 Country of Publication: Japan 
CODEN : JSGRD5 ISSN: 0387-5806 

Language: Japanese Document Type: Journal Paper (JP) 
Treatment: Practical (P) 

Abstract: The paper describes the basic design of the SHOSHI operating 
system (OS) that supports handwriting interfaces. The key concept of this 
OS is to present the fundamental architecture of a paper metaphor. We 
propose the concept of "virtual paper", conceived to duplicate useful 
attributes of the real thing. From our experience in pen application 
development, handwriting interfaces have the following characteristics: 
diversity, polysemy and immediate pen response. "Virtual paper" also has 
these characteristics. To utilize diversity, attributes-data type and 
handling procedures-are freely definable by the user. To utilize polysemy, 
"virtual paper" provides data conversion by the way of attribute conversion 
and data linking mechanism. Unifying the system interface into "paper" we 
manage the "virtual paper" features in the OS layer. Moreover, attributes 
must be- definable- by user programs — ^and — registered in the OS 
dynamically. However, conventional OS ' s cannot register API ( 
Application Program Interface) 1 s dynamically. To utilize dynamic API 

registration, the OS provides dynamic linking. For storing linked data, the 
OS provides a one level store facility and the OS is implemented from each 
resource management subsystem in order to maintain immediate pen response. 
As a result of this design, this system can present the system interface 
unified into "paper". (19 Refs) 

Subfile: C 

Descriptors: application program interfaces; data structures; 
handwriting recognition ; operating systems (computers) ; user interfaces 
; word processing 

Identifiers: SHOSHI operating system; handwriting interfaces; paper 
metaphor; virtual paper; pen application development; data type; data 
handling; polysemy; data conversion; attribute conversion; data linking 
mechanism; OS layer; Application Program Interface; dynamic API 
registration; dynamic linking; resource management subsystem; system 
interface 

Class Codes: C6180 (User interfaces); C6120 (File organisation); C6150J 
(Operating systems); C6150E (General utility programs ) ; C6130D (Document 
processing techniques) 

Copyright 1995, IEE 



27/5/4 (Item 1 from file: 233) 

DIALOG (R) File 233: Internet & Personal Comp. Abs . 
(c) 2003, EBSCO Pub. All rts. reserv. 

00540826 99PK07-204 

Back Orifice returns, poses Win NT threat 

Rapoza, Jim 

PC Week , July 19, 1999 , vl6 n29 pi, 20, 2 Page(s) 
ISSN: 0740-1604 

Company Name: Cult of the Dead Cow; Microsoft 
Product Name: BackOffice 2000; Microsoft Windows NT 
Languages: English 

Document Type: Articles, News & Columns 
Geographic Location: United States 

Discusses the release of Back Office 2000, a hacker application by Cult 
of the Dead Cow of Lubbock, TX. Says that the latest version makes it 
possible for a hacker to take over Windows NT systems and is open-source, 
making code changes harder to detect by anti- virus scanners. Notes that 
these features pose more of a threat to corporate systems. Recommends that 
companies that discover infected machines do a system cleanup by looking 



for recently modified files that do not fit known applications. Explains 
that it may be necessary to do a complete rehab of the operating system. 
Concludes that the most dangerous of the new features is a remote control 
function, which can make any directory a shared directory. Observes that 
this could allow an internal hacker to control NT machines, (cb) 

Descriptors: Hackers; Windows; Virus ; Operating Systems ; Direct 
ories A Secu ; Security 

Identifiers: BackOffice 2000; Microsoft Windows NT; Cult of the Dead 
Cow; Microsoft 



27/5/5 (Item 2 from file: 233) 

DIALOG (R) File 233: Internet & Personal Comp. Abs . 
(c) 2003, EBSCO Pub. All rts. reserv. 

00447303 97IW01-321 

Norton Utilities 2.0 remains strong, adds features 

Peschel, Joe 

InfoWorld , January 27, 1997 , vl9 n4 pl25, 1 Page(s) 
ISSN : 0199-6649 
Company Name : Symantec 

Product Name: Norton Utilies 2.0 for Windows 95 

Languages: English 

Document Type: Software Review 

Grade (of Product Reviewed) : B " ~~~~ ~ 

Hardware/Software Compatibility: Microsoft Windows 95; IBM PC 
Compatible 

Geographic Location: United States 

Presents a favorable review of Norton Utilities 2.0 for Windows 95 
($79), a disk utility from Symantec Corp. of Cupertino, CA (800, 541). Says 
that Version 2.0 includes all the previous product's capabilities, in 
addition to improvements such as new sensors that monitor drive performance 
and Internet traffic. Spotlights NU 2.0 f s ability to easily edit Windows 
95 Registry and automatically update virus definitions. However, 

complains that the utility is unable to use the File compare feature on all 
files, and Registry tools are incapable of compacting the Registry. Lists 
nine new and improved features. Contends that if you have the first 
release, the additional ease-of-use options and the multimedia reference 
are worth the upgrade. Contains one screen display, one product summary, 
and one table, (smg) 

Descriptors: Utility Program; Virus ; Window Software; Web Browsers; 
File Management; Software Review; Internet 

Identifiers: Norton Utilies 2.0 for Windows 95; Symantec 



27/5/6 (Item 3 from file: 233) 

DIALOG (R) File 233: Internet & Personal Comp. Abs. 
(c) 2003, EBSCO Pub. All rts. reserv. 

00432290 96IW08-213 

Ornetix CD-Vision offers scalable, easy-to-use CD management 

Marshall, John 

InfoWorld , August 19, 1996 , vl8 n34 pN/7, 1 Page(s) 
ISSN: 0199-6649 

Company Name: Ornetix Network Products 

Product Name: CD-Vision; CD-Commander 

Languages: English 

Document Type: Software Review 

Grade (of Product Reviewed) : B; B 

Hardware/Software Compatibility: IBM PC Compatible; NetWare; Microsoft 
Windows; Microsoft Windows 95; Microsoft Windows NT 
Geographic Location: United States 

Presents a favorable review of CD-Vision v3 . 0 ($795 for 10 users) and 
CD-Commander vl.02 ($295), CD-ROM client /server software from Ornetix 
Network Products of San Jose, CA (800, 408) . CD-Vision runs on IBM PC 
compatibles with NetWare 2.x, 3.x, or 4.x, or Windows NT. CD-Commander runs 
on PCs with Windows 3.x, 95, or NT. Explains that CD-Vision can turn almost 
any NetWare client workstation with locally attached, advanced SCSI 



programming interface-compliant SCSI CD-ROM drives into a dedicated, 
sharable CD-ROM server. Reports that CD-Vision can share other types of 
optical SCSI devices such as WORM and magneto-optical drives, and can 
support up to 250 concurrent users. States that CD-Commander manages all 
connection operations transparently and allows you to create titles from 
the management workstation. However, says CD-Vision has no native Novell 

Directory Services and Windows NT environment support. Includes two 
screen displays, one sidebar, and a products summary, (jo) 

Descriptors: Client-Server Computing; CD-ROM Drive; Software Review; 

Window Software; Networks 

Identifiers: CD-Vision; CD-Commander; Ornetix Network Products 



27/5/7 (Item 4 from file: 233) 

DIALOG (R) File 233: Internet & Personal Comp. Abs . 
(c) 2003, EBSCO Pub. All rts. reserv. 

00429603 96OL07-011 

Tweaking your computer 

Crawford, Walt 

Online , July 1, 1996 , v20 n4 pi '2-11 , 6 Page(s) 
ISSN: 0146-5422 
Languages: English 

Document Type: Feature Articles and News 

Geographic Location: United States " ~~" 

Focuses on utility software for computer systems. Overviews seven 
categories of utility software for Windows 3.x, Windows 95, and Mac OS. 
Claims that screensavers are the most popular utility, even though they are 
no longer necessary. Lists other utilities as operating system 
extensions, which add or enhance operating system functions; interface 
enhancements and replacements, which allow the look and feel of the 
computer to be customized; memory and performance, which boost RAM and 
speed up applications; backup programs, which store and protect data; 

virus protection, which protects the computer from damaging viruses; and 
diagnostic and repair tools, which includes disk performance functions. 
Conclud that utility programs are hard to do without. Includes one sidebar, 
(kgh) 

Descriptors: Software Tools; Utility Program; Troubleshooting; 
Productivity Software; Memory; Virus ; Screen Savers 



27/5/8 (Item 5 from file: 233) 

DIALOG (R) File 233: Internet & Personal Comp. Abs. 
(c) 2003, EBSCO Pub. All rts. reserv. 

00424465 96CW05-007 

Novell cozies up to "net — Lightweight Directory Access Protocol 
support opens NDS to the Internet 

DiDio, Laura 

Computerworld , May 6, 1996 , v30 nl9 p69, 1 Page(s) 
ISSN: 0010-4841 
Company Name: Novell 
Product Name: NetWare 
Languages: English 

Document Type: Feature Articles and News 
Geographic Location: United States 

Reports the Novell's support of the lightweight directory access 
protocol (LDAP) will enable businesses to use the Internet to access 
information stored in NetWare file servers. Says the protocol developed by 
the University of Michigan was designed to provide MS-DOS, Windows, and 
Macintosh systems with thin clients capable of accessing the Internet . Adds 
that LDAP is expected to be adopted by the Internet Engineering Task Force. 
Also says Novell's support for LDAP will enable software application 
developers to create NetWare Directory Services (NDS) applications by using 
one set of application programming interfaces. Notes that LDAP itself 
does not include strong security authentication . Includes a chart, (dpm) 
Descriptors: Standards; Directories ; Internetworking; Network 
Operating Systems 



Identifiers: NetWare; Novell 



27/5/9 (Item 6 from file: 233) 

DIALOG (R) File 233: Internet & Personal Comp. Abs . 
(c) 2003, EBSCO Pub. All rts. reserv. 

00423691 96PM05-069 

Plug the gaps in Windows 95 — Ten things Microsoft left out 

Fields, Bill 

PC/Computing , May 1, 1996 , v9 n5 pl34-142, 8 Page(s) 

ISSN: 0899-1847 

Company Name: Microsoft 

Product Name: Microsoft Windows 95 

Languages : English 

Document Type: Feature Articles and News 

Hardware/Software Compatibility: IBM PC Compatible; Microsoft Windows 
Geographic Location: United States 

Presents a section listing the ten products best suited to compensating 
for weaknesses in Windows 95. The ten areas of weakness (and the products 
recommended to solve the problem) are: program launchers (Norton Navigator 
95), file management (Norton Navigator 95 and Quick View Plus), disk 
diagnostics (Norton Utilities 95), memory management (QEMM 8), system 
maintenance (Metz Scheduler), font management (FontMinder 3.0.4), disk 
c omp r e s s i o n (Microsoft's Plus "95")", " appli"c at ion" "unins t all ers { C 1 e a n S we ep 
95), virus protection (Dr. Solomon's Anti- Virus Toolkit 95), and file 
transfer (LapLink for Windows 95 ) . Includes a directory of sources of 
the Windows utilities recommended and others described as well as estimated 
street prices. Includes one illustration and 10 screen displays, (djd) 

Descriptors: Window Software; Utility Program; File Management; 
Memory; Compression; Virus ; Data Transmission 

Identifiers: Microsoft Windows 95; Microsoft 



27/5/10 (Item 7 from file: 233) 

DIALOG (R) File 233: Internet & Personal Comp. Abs. 
(c) 2003, EBSCO Pub. All rts. reserv. 

00420082 96WN04-042 

Prevent a titanic disaster — When you get that sinking feeling, throw 
your PC a lifeline! 

Kenworthy, Karen 

Windows Magazine , April 1, 1996 , v7 n4 pl78-188, 5 Page(s) 
ISSN: 060-1066 
Languages: English 

Document Type: Feature Articles and News 
Geographic Location: United States 

Focuses on minimizing losses from computer down time by attempting to 
forestall such problems as hard disk crashes, viruses, or operating system 
malfunctions. Advises running a virus -checking program if you notice slow 
or strange performance from your system. Also recommends testing the hard 
disk with ScanDisk, checking for overheating, re-seating all adapter cards, 
and reinstalling software. Discusses how to restore the Registry by 
removing the System, Hidden, and Read-Only attributes from files in Windows 
95. Attention is given to the Windows 95 SYSTEM. DAT, SYSTEM . 1ST, and 
USER. DAT files; and explains how to rebuild a hard disk. Sidebars consider 
installing a hard disk drive, how Control Panel can make a new startup 
diskette for you, and the organization of Windows NT and 95 f s Registry 
to store system settings and driver information. Includes three screen 
displays, (jo) 

Descriptors: Troubleshooting; Diagnostics; Hard Disk Drive; Operating 
Systems; Window Software; Virus 
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00417152 96PV03-003 

Ward off infections under Windows 95 — Windows computing 

Holzberg, Carol S 

PC Novice , March 1, 1996 , v7 n3 p21-22, 2 Page(s) 
ISSN: 1052-1186 

Company Name: S&S Software International; Symantec; McAfee 
Product Name: Dr. Solomon's Anti- Virus ToolKit For Windows 95; Norton 
Antivirus For Windows 95; WebScan; VirusScan for Windows 95 
Languages : English 

Document Type: Buyer and Vendor Guide 
Grade (of Product Reviewed) : B; B; B; B 

Hardware/Software Compatibility: IBM PC Compatible; Microsoft Windows 

95 

Geographic Location: United States 

Presents a comparative review of four virus -protection programs 
designed for Windows 95. Provides favorable reviews of: Dr. Solomon's Anti- 
Virus ToolKit For Windows 95 ($125, list ) from S&S Software 
International (800, 617), which can detect and repair damage caused by 
7,500 different viruses; Norton Antivirus For Windows 95 ($79, street) from 
Symantec (800, 503), which is customizable; VirusScan For Windows 95 ($45 
street) from McAfee Inc. (408), which provides superior integration with 
Windows 95 Explorer, but is less robust than the other products reviewed; 
and WebScan ($45) from McAfee Inc. (408), which is designed to protect from 
online viruses. Includes two screen displays, (bjp) 

Descriptors: - Virus ; Software "Review; — Disk Files; Security; Utility 
Program; Window Software 

Identifiers: Dr. Solomon's Anti- Virus ToolKit For Windows 95; Norton 
Antivirus For Windows 95; WebScan; VirusScan for Windows 95; S&S 
Software International; Symantec; McAfee 



27/5/12 (Item 9 from file: 233) 
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00403408 95PI11-263 
InocuLAN 3.0 

Boyle, Padraic 

PC Magazine , November 21, 1995 , vl4 n20 p258-259, 2 Page(s) 
ISSN: 0888-8507 

Company Name: Cheyenne Software 
Product Name: InocuLAN 
Languages: English 
Document Type: Software Review 
Grade (of Product Reviewed) : B 

Hardware/Software Compatibility: IBM PC Compatible; Microsoft Windows 
Geographic Location: United States 

Presents a favorable review of InocuLAN 3.0 ($395 for 25 nodes to $995 
for 1, 000 nodes), an antivirus program for LANs from Cheyenne Software Inc. 
(800). The program protects NetWare 3.x and 4.x file servers and DOS, 
Windows, and Macintosh clients. The program allows users to schedule 
connections to Cheyenne ? s BBS for automatic updating of virus 
information. After the files are downloaded, the program propagates them to 
every server and client running InocuLAN. Users of Cheyenne's ARCserve 
backup program can incorporate it with InocuLAN which enables the 
administrator to be confident that both the server and backup are 
uninfected. Registered ARCServe users can obtain InocuLAN for ARCServe for 
half the list price. InocuLAN for Windows NT ($895 for one server, 
$3,995 for five servers) is also available and is compatible with Microsoft 
Systems Management Server, (djd) 

Descriptors: Virus ; Local Area Networks; Software Review; Window 
Software 

Identifiers: InocuLAN; Cheyenne Software 
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00294213 92IW11-045 

Supporting remote users of your LAN- -Part 1: the basics 

Merenbloom, Paul 

InfoWorld , November 2, 1992 , vl4 n44 p44, 1 Page(s) 
ISSN: 0199-6649 
Languages: English 

Document Type: Feature Articles and News 
Geographic Location: United States 

LAN TALK column presents ideas for LAN administrators to consider when 
implementing remote-access computing on your LAN including security, system 
integrity, and ease of use. Recommendations include: uses a dial-back 
feature; use software with multiple passwords; regularly change passwords; 
install a virus -checking program on the modem-equipped machines; secure 
the files and directories on the host PC; use network operating system 
tools to identify, log , and restrict access; consider an 800 number; 
plan use of your resources; and develop and distribute a reference g for 
remote computing, (jb) 

Descriptors: Remote Computing; Networks; Administration; MIS 
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00282721 92PW07-052 

Antivirus software — You escaped Michelangelo, but you may not be so 
lucky next time. Here are 24 antivirus programs that will let you breathe a 
little. . . 

Marshall, Patrick 

PC World , July 1, 1992 , vlO n7 pl99-203, 5 Page(s) 
ISSN: 0737-8939 
Languages : English 

Document Type: Buyer and Vendor Guide 
Geographic Location: United States 

Presents a tutorial on viruses, with a buyer's guide comparing features 
of 24 antivirus software packages. For each of the programs listed, the 
table indicates what portion of a disk the program scans for viral 
signatures, what it monitors, whether it provides network support, 
frequency and cost of updates, method of obtaining an update, and 
operating systems supported. A sidebar lists the 10 most frequently 

occurring viruses during the first quarter of 1992. Includes two 
illustrations, one table (djd) 

Descriptors: Virus ; Vendor Guide; Security 



27/5/15 (Item 12 from file: 233) 
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00203142 89BY10-038 

A compendium of OS/2 applications A new OS /2 application guide lists 
hundreds of programs 

Minasi, Mark J 

BYTE , October 1, 1989 , vl4 nlO pl43-144B, 3 Pages 

ISSN: 0360-5280 

Languages: English 

Document Type: Column 

Geographic Location: United States 

OS/2 NOTEBOOK column presents some OS/2 applications: Discus ($3,600), a 
WORM controller board and drivers for OS/2; HyperAccess /5 ($199), a 
communications program; BBS software ($80) which lets BBSes run in the 
background; MsgVu ($35) , a facility which lets members of electronic 
conferences save and categorize messages; PrintQ ($199), a mainframe-style 
disk-based print spooler; Prolog ($650), a database package. Includes a 
directory o these products 1 makers, (irl) 

Descriptors: OS/2; Controller; Data Communication; Computer Bulletin 
Board Systems; Computer Conferencing; Database; WORM 



Identifiers: BBS software; Discus; HyperAccess/5; MsgVu; PrintQ; 
MichTron; Advanced Graphics Applications; Hilgraeve; Dave Bricc^etti and 
Associates ; Software Directions 

27/5/16 (Item 1 from file: 95) 

DIALOG (R) File 95 : TEME-Technology & Management 
(c) 2003 FIZ TECHNIK. All rts. reserv. 

00887054 195034559259 
Titel japanisch 

(Entwurf des Betriebssystems SHOSHI zur Unterstuetzung von 
Handschriftschnittstellen) 

(Basic design of SHOSHI operating system that supports handwriting 
interfaces ) 

Hayakawa, E; Namiki, M; Takahashi, N 

Dept. of Comput. Sci . , Tokyo Univ. of Agric. & Technol . , Japan 
Transactions of the Information Processing Society of Japan, v35, nl2, 
pp2590-2601, 1994 

Document type: journal article Language: Japanese 
Record type: Abstract 
ISSN: 0387-5806 

ABSTRACT: 

The paper describes the -basic design- of— the SHOSHI -operating system (OS) 
that supports handwriting interfaces. The key concept of this OS is to 
present the fundamental architecture of a paper metaphor. We propose the 
concept of "virtual paper", conceived to duplicate useful attributes of the 
real thing. From our experience in pen application development, handwriting 
interfaces have the following characteristics: diversity, polysemy and 
immediate pen response. "Virtual paper" also has these characteristics. To 
utilize diversity, attributes-data type and handling procedures-are freely 
definable by the user. To utilize polysemy, "virtual paper" provides data 
conversion by the way of attribute conversion and data linking mechanism. 
Unifying the system interface into "paper" we manage the "virtual paper" 
features in the OS layer. Moreover, attributes must be definable by user 
programs and registered in the OS dynamically. However, conventional 
OS 1 s cannot register API ( Application Program Interface) 's 
dynamically. To utilize dynamic API registration, the OS provides dynamic 
linking. For storing linked data, the OS provides a one level store 
facility and the OS is implemented from each resource management subsystem 
in order to maintain immediate pen response. As a result of this design, 
this system can present the system interface unified into "paper". 

DESCRIPTORS: DATA MODELS; OPERATING SYSTEM — COMPUTERS; USER INTERFACES; 
MESSAGE PROCESSING; DATA; DATA CONVERTERS; HANDWRITING; APPLICATION 
SOFTWARE; AUTOMATIC READING; CHARACTER RECOGNITION ; HANDWRITING 
RECOGNITION 

IDENTIFIERS: DATA HANDLING; APPLICATION PROGRAM INTERFACES; SHOSHI 
OPERATING SYSTEM; HANDWRITING INTERFACES; PAPER METAPHOR; VIRTUAL PAPER; 
PEN APPLICATION DEVELOPMENT; POLYSEMY; ATTRIBUTE CONVERSION; DATA LINKING 
MECHANISM; OS LAYER; APPLICATION PROGRAM INTERFACE; DYNAMIC API 
REGISTRATION; DYNAMIC LINKING; RESOURCE MANAGEMENT SUBSYSTEM; SYSTEM 
INTERFACE; Bet riebssys tern; Handschrif t sennit tstelle 
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51 874560 WINDOWS94 OR WINDOWS 98 OR WINDOWS3 . 1 OR WINDOWS()(95 OR 98 

OR XP OR ME OR MELLENIUM () EDITION OR NT OR 2000 OR OS OR OPER- 
ATING { ) SYSTEM OR 3.1) OR OS OR OPERATING () SYSTEM? 

52 5969408 REGISTRY OR REGISTRIES OR REGISTER? OR LIST? ? OR DIRECTOR? 

OR INDEX? OR CHECKLIST? OR CHECK () LIST? OR ITEMIZATION OR LOG 
OR INDICES 

53 7791019 ALTER? OR UPDAT? OR UP { ) (DATE? ? OR DATING OR GRAD???) OR - 

UPGRAD??? OR CHANG??? OR MODIF???? OR EDIT??? OR REVIS??? OR - 
REVAMP? OR REWORK? 

54 2122 EXECUTABLE () (APPLICATION? OR PROGRAM?) 

55 217498 VIRUS OR MALICIOUS () CODE? OR TROJAN () HORSE OR WORM 
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'26/3,K/l (Item 1 from file: 647) 

DIALOG (R) File 647: CMP Computer Fulltext 
(c) 2003 CMP Media, LLC. All rts. reserv. 

01181810 CMP ACCESSION NUMBER: WIN19990101S0062 

Using Windows 2000 - Windows 2000 isn't on the showroom floor yet, but 

we'll take you on a test drive with the most advanced Windows to date. 

(Cover Story) 
Scot Finnie, Senior Technology Editor 
WINDOWS MAGAZINE, 1999, n 1001, PG146 
PUBLICATION DATE: 990101 

JOURNAL CODE: WIN LANGUAGE: English 

RECORD TYPE: Fulltext 
SECTION HEADING: Features 
WORD COUNT: 3708 

Windows 2000 Professional. The Index Server provides local content 
indexing as a background service, like a Web worm for your hard drive. 
You determine what directories it will index and the basic properties of 
files it will track. Switching this service... 



26/3,K/2 (Item 2 from file: 647) 

DIALOG (R) File 64 7: CMP Computer Fulltext 
(c) 2003 CMP Media, LLC. All rts. reserv. 

01156508 CMP ACCESSION NUMBER: IWK1 9980323S0052 

TNG: A World View - CA ! s Unicenter TNG 2.1 covers almost all the bases 
with its wide-ranging enterprise -management framework and makes it 
simple to extend with its software toolkits. But there are some areas 
where you'll have to turn to other products for more depth. 

Sean Gallagher 

I N FORMAT I ONWE E K , 1998, n 674, PG67 
PUBLICATION DATE: 980323 

JOURNAL CODE: IWK LANGUAGE: English 

RECORD TYPE: Fulltext 

SECTION HEADING: Inf ormationWeek Labs 
WORD COUNT: 4 919 

system. This category includes : operating-system agents, which can 
monitor almost every aspect of a machine 1 s operating system ; log 
agents, which can monitor events and alerts logged to a file or log 
system by the operating system and applications running on it; 
process agents, which monitor the activity of specific applications or 
system processes running within the operating system; and script agents, 
which can run scripts and executable programs on a system. Script 
agents can be used in conjunction with any of the other system agents... 



26/3, K/3 (Item 3 from file: 647) 

DIALOG (R) File 647: CMP Computer Fulltext 
(c) 2003 CMP Media, LLC. All rts. reserv. 

01059430 CMP ACCESSION NUMBER: IWK19950724S0041 
Faux-NetWare On Windows NT (spotlight) 
James E. Gaskin 

INFORMATIONWEEK, 1995, n 537, PG72 
PUBLICATION DATE: 950724 

JOURNAL CODE: IWK LANGUAGE: English 

RECORD TYPE: Fulltext 
SECTION HEADING: OpenLabs 
WORD COUNT: 17 7 8 

many applications. Without support for NetWare 4.1, these products 
do not allow you to use NetWare Directory Services. 

Many Windows NT options, such as SNA gateways and tape backup 

systems, duplicate NetWare server functions. However, many NetWare 

NLMs-such as Internet gateways, most accounting software, imaging systems, 



management and control programs, and virus detection -either do not 
exist for Windows NT or have a single supplier. Further, many NetWare 
applications require. . . 

26/3, K/4 (Item 4 from file: 647) 

DIALOG (R) File 647: CMP Computer Fulltext 
(c) 2003 CMP Media, LLC. All rts . reserv. 

00616073 CMP ACCESSION NUMBER: CWK19881128S0933 

DELAY ON SQL SERVER Microsoft Corp. and Ashton-Tate, Torrance, Calif., 
recently announced. . . 

COMMUNICATIONSWEEK, 1988, n 224, 16 
PUBLICATION DATE: 881128 

JOURNAL CODE: CWK LANGUAGE: English 

RECORD TYPE: Fulltext 
SECTION HEADING: 224PG16 
WORD COUNT: 5 62 

... the Bytex Unity NetView Link software costs $12,600. 

VIRUS SOFTWARE SPREADS 

The aftermath of the Internet virus attack (CommunicationsWeek, 
Nov. 7) has spawned a new market of "anti-infection" software. Two 
software developers recently. . . __ 

...USA, Fort Lee, N.J. Zeus 1 new Immunetec PC, a board-level product, 
checks files in a directory before the DOS operating system is 
invoked and detects when users tamper with code on system files. 
Immunetec PC runs on IBM PC, XT, AT and... 
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DIALOG (R) File 275: Gale Group Computer DB(TM) 
(c) 2003 The Gale Group. All rts. reserv. 

02074158 SUPPLIER NUMBER: 19516681 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

Enterprising Web servers, (five high-end Web servers reviewed) (includes 

related article on how products were tested) (Software 

Review) (Evaluation) 

Krick, Jim 

Computer Shopper, vl7, n7, p614(8) 
July, 1997 

DOCUMENT TYPE: Evaluation ISSN: 0886-0556 LANGUAGE: English 

RECORD TYPE: Fulltext; Abstract 

WORD COUNT: 6904 LINE COUNT : 00569 

... at Interfaces 

A Web-server vendor can implement a management interface in two ways : 
as a Windows executable application or as an HTML interface. While both 
have merit, an HTML management interface is typically much slower than a 
Windows executable program . And in addition to providing the quickest 
responses to commands, a Windows executable will be familiar to Windows 
users, relying on familiar tabbed dialog boxes or property sheets to make 
configuration changes to the Windows NT Registry in a fashion 
transparent to the user. 

Microsoft's IIS and Netscape's Enterprise and FastTrack servers... 



26/3 ,K/6 (Item 2 from file: 275) 

DIALOG (R) File 275: Gale Group Computer DB(TM) 
(c) 2003 The Gale Group. All rts. reserv. 

01917314 SUPPLIER NUMBER: 18135727 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

Make Win 95 do it your way. (Customizing Windows 95) (includes relaetd 

article on basics of editing Registry) (Product Support) (Brief 

Article) (Tutorial) 

Pastrick, Greg 

Windows Sources, v4, n4, pl42(3) 



'April, 1996 

DOCUMENT TYPE: Brief Article Tutorial ISSN: 1065-9641 LANGUAGE: 

English RECORD TYPE: Fulltext 

WORD COUNT: 968 LINE COUNT: 00077 

... OS that can support multiple users and configurations. 

For a database that is so critical to the OS , the Registry i s 
remarkably configurable. Windows 95 provides two low-tech utilities to 
modify the Registry. The Registry Editor , an executable program in 
the Windows folder, uses an Explorer-like interface with basic editing 
features to manipulate Registry entries. The System Policy Editor lets 
you restrict features and functions to specific users and computers from an 
equally simple interface. Unlike the Registry Editor , the System Policy 
Editor is found only on the Win 95 i nstallation CD. On a non networked 
system, System Policy Editor directly edits the Registry; on a 
networked system, it enforces system policies across the network. 

Both utilities are extremely. . . 



26/3,K/7 (Item 3 from file: 275) 

DIALOG (R) File 275: Gale Group Computer DB(TM) 
(c) 2003 The Gale Group. All rts. reserv. 

01904741 SUPPLIER NUMBER: 18015572 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

Inoculating NT servers: anti -virus software shows potential. (InocuIAN 1.01 

for Windows NT) (includes related article on test methodology) (PC Week 

Netweek) (Software Review) (Evaluation) 

Phillips, Ken 

PC Week, vl3, n7, pNl(4) 

Feb. 19, 1996 

DOCUMENT TYPE: Evaluation ISSN: 0740-1604 LANGUAGE: English 

RECORD TYPE: Fulltext; Abstract 

WORD COUNT: 1827 LINE COUNT: 00156 

... NT is the only virus protection product currently available for 

Windows NT servers. The product offers good detection and is easy to use, 
but several areas need some work. Unified Front: InocuLAN ! s BackOffice 
certification means that the product supports unified Windows NT log 
-ins, runs as a service, and can be remotely deployed through SMS . 
Corporate Scoreboard: InocuLAN 1.01... 
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DIALOG (R) File 275:Gale Group Computer DB(TM) 
(c) 2003 The Gale Group. All rts. reserv. 

01857740 SUPPLIER NUMBER: 17497280 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

Antivirus software. (overview of four articles on anti -virus software 

searchable under "Antivirus Software") (Picking Up the Pieces) (Software 

Review) (Evaluation) 

Patz, Joel T. 

PC Magazine, vi4, n20, pl80(2) 
Nov 21, 1995 

DOCUMENT TYPE: Evaluation ISSN: 0888-8507 LANGUAGE: English 

RECORD TYPE: Fulltext; Abstract 

WORD COUNT: 104 2 LINE COUNT: 00083 

with the previously known record and tell you that something has 
changed. Since Windows 95 doesn't recognize this new application, a 
dialog box appears, informing you that the MBR has been modified while 
Windows 95 was not running and that you may have a virus . on the list 
Windows 95 also maintains a list of known, proven, "safe" DOS 
device drivers. If you try to add a new INT-13- or INT-21-based device 
driver that Windows 95 doesn't recognize , you'll be told that you're now 
running in DOS compatibility mode. So if a virus doesn't infect the MBR 
but makes its inroads via a device driver, a message will notify. . - 



26/3, K/9 (Item 5 from file: 275) 

DIALOG (R) File 275: Gale Group Computer DB(TM) 
(c) 2003 The Gale Group. All rts. reserv. 

01674879 SUPPLIER NUMBER: 15068645 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

1994 market directory issue: more than 600 information technology company 

listings . (vendors of health techno logy- related products and services , 

organizations and events) (Directory) 

Health Management Technology, vl5, n3, pl4(113) 
Feb 15, 1994 

DOCUMENT TYPE: Directory LANGUAGE: ENGLISH RECORD TYPE: FULLTEXT ; 

ABSTRACT 

WORD COUNT: 69033 LINE COUNT: 06228 

Using the 1994 Health Management Technology Market Directory is easy. 
The directory is divided into two sections. The first section, Alpha 
Listings, is an allphabetical list of all organizations ... customizable . 
SAVA f s turn-key solutions are hardware-based and network-oriented, and 
incorporate smart card access, user authentication and identification, 
encryption adn audit functionality, and carry key government certifications 
and validations . 

Scantron Corp. 1361 Valencia Ave. Tustin, CA 92680-6463 (800) 
722-6876 ext. 650; (714) 259-8887... 
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01260828 SUPPLIER NUMBER: 07218861 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

Hard Disk Organizer - type around long pathlists. (Software Review) 
(evaluation) 

Smith, Brian R. 
Rainbow, v8, n4, pl36(2) 
Nov, 1988 

DOCUMENT TYPE: evaluation ISSN: 0746-4797 LANGUAGE: ENGLISH 

RECORD TYPE: FULLTEXT; ABSTRACT 

WORD COUNT: 531 LINE COUNT: 00038 

... In a hard drive system, the CMDS directory will invariably become 

unmanageable due to the number of executable programs found there. Hard 
Disk Organizer allows a user to develop menu-driven pathlists so that any 
application ... 

...accessed. Your OS-9 programs can then be called up with a single 
keystroke. It can also change the data and execution directories of any 
OS -9 operating system. 

With my 512K CoCo 3, I was capable of building the required "menu 
options . . . 
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DIALOG (R) File 674: Computer News Fulltext 

(c) 2003 IDG Communications. All rts. reserv. 

075368 

Vendors offer solutions for Worm. ExploreZip virus 

Byline: Margret Johnston 
Journal: Network World 
Publication Date: June 14, 1999 
Word Count: 4 39 Line Count: 4 2 

Text : 

. . . providers have released updates and other services to prevent their 
customers from falling victim to the destructive Worm .ExploreZip Trojan 
horse virus . Symantec, Network Associates, Trend Micro and Panda 

Software are among the companies that have posted virus -definition sets 
that can detect the new virus . Meanwhile, FastLane Technologies, 



developer of enterprise Windows NT directory management solutions, 
released an application to detect and disable the virus . The virus 
affects Microsoft Outlook and Exchange users. Worm .ExploreZip spreads 
when a user receiving . mail that appears to be from someone they know 
unwittingly opens. . . 

... receive a warning before attachments run. On Sunday, a user in Israel 
sent a copy of the virus to the Symantec Antivirus Research Center in 
Santa Monica, Calif. Consequently, Symantec made its Norton Antivirus 
definitions available for download on Wednesday night. Norton Antivirus 
users can download the current virus definitions through a service called 
LiveUpdate. Network Associate's Antivirus Emergency Response Team received 
information on the virus at 2 a.m. Wednesday and promptly posted a 
remedy, said Sal Viveros, group marketing manager for Network Associate's 
Total Virus Defense. The update protects users of McAfee VirusScan and 
users of Doctor Solomon Antivirus Toolkit, who are. . . 

. . . and Germany. Users who want to avoid a download and just want to find 
out whether the virus has been sent to them can go to www.mcafee.com for 
an online scan. Traffic at that site has increased 600% since word of the 
virus came out, Viveros said. About 60% of Network Associate's top tier 
customers suffered severe damage caused by the virus believed to have 
originated in Israel, Viveros said. All the information Network Associates 
researchers collected has been... 



... said. FastLane is not a traditional antivirus vendor. However, the 
company is offering a solution. FastLane provides detection software that 
can help contain the damage, said Jan Kaminski, president of FastLane 
Technologies based in Halifax, Nova Scotia. "What we can do from a central 
administrative desk is detect whether or not the virus is running and 
shut down a remote machine and disable the virus , " Kaminski said. "Then 
the user has to use proper antivirus software to eradicate the virus . " 
AT&T, Microsoft and Dell have ordered FastLane 1 s detection software to 
protect their internal networks. Most organizations are now aware of the 
virus , but the challenge for administrators managing networks with 
thousands of users remains, Kaminski said. 
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00596162 
INTRANETS WALL OFF THE WORLD 

ELECTRONIC MESSAGING NEWS 

March 18, 1998 VOL: 10 ISSUE : 6 DOCUMENT TYPE: NEWSLETTER 

PUBLISHER: PHILLIPS BUSINESS INFORMATION 

LANGUAGE: ENGLISH WORD COUNT: 1318 RECORD TYPE: FULLTEXT 

(c) PHILLIPS PUBLISHING INTERNATIONAL All Rts. Reserv. 

TEXT: 

...sure enough, it has finally come to 
pass . 

Firewalls are in everything from routers and switches to 

operating systems to traditional stand-alone devices. Market 
forces, too, have caused a consolidation of security vendors as 
companies ... in electronic commerce. These services include three 
hot areas right now: Firewall protection, security assessment 
and intrusion detection , says Mathew Kovar, senior analyst at 
the Yankee Group in Boston. 

"From an industry perspective, it's... They have set themselves up at 
the center of the enterprise security market." 
The OPSEC alliance uses application programming 
interfaces (APIs) developed by Check Point to integrate third- 
party products into the security platform. Check Point will 
supply the following APIs: 

* Content Vectoring Protocol, which enables integration 



of virus scanning software with other content inspection 
programs ; 

* Suspicious Activity Monitoring Protocol, which enables 

the integration of suspicious activity monitoring programs and 
allows them to modify access privileges upon detection of 
suspicious network activity, such as several attempts to gain 
unauthorized access; and 

* Uniform Resource Locator (URL) Filtering Protocol, 

which enables the integration of URL list services to limit 
access to specific Web pages. 

In addition to providing the APIs, Check Point is... 
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...the IA-64 Pre-silicon Software Development Environment represents a key 
milestone for the Solaris IA-64 operating system ", said Mike Pope, 
Director of Server Software Programs, Intel Corporation. "This is an 
indicator of the strong industry-wide momentum behind. . . 

...bit applications today with the Solaris 7 Operating Environment running 
on 64-bit Sun systems. The Solaris Application Programming Interface 
(API) and Device Driver Interface (DDI) are common across all Solaris 
platforms. This means that ISVs ... Corporation NCR Corporation (NYSE: NCR) 
is in the business of transforming transactions into relationships. NCR is 
a recognized world leader in data warehousing solutions, ATMs , 
point-of-sale, high performance scanners, and support services for. . . 
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...games and a CD player with Internet support, as well as powerful 
utilities such as an anti- virus utility which works in cooperation with 
Windows 98 as a built-in system tool, and a disk... 

...digital camera, touching up and eliminating red-eye, changing image 
size, adjusting brightness and contrast and cropping. Virus Scanning and 
Disinfection. Plus! 98 includes McAfee VirusScan. Working in cooperation 
with the Windows 98 built-in... 

...scan the hard disk while the screen saver is running to ensure a safe 
computing environment. (McAfee Virus Scan works on PC/AT compatibles 



machines only.) Enhanced Disk Clean-Up. Plus! 98 detects rarely or never 
used files, allowing users to deleting those files from the system and 
recover disk. . . 

...Plus! 98 — Introduction Date: Saturday, July 25, 1998 — Estimated 
Retail Price: Yen 5,800 Microsoft, Windows and Windows NT are 
registered trademarks of Microsoft Corporation in the U.S. and other 
countries. Windows is formally specified as "Microsoft... 
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...partitioning and is parti cularl y ~ s uit e d ~ to applications invo 1 ving - " ^ 
networks, such as the Internet. HARDWALL provides protection against virus 

attack, hacking, data theft, illegal access and data corruption and is 
designed to meet a user's. . . 

...Write Many Recoverable (WMR) partition. If information stored in a WMR 
partition is corrupted for any reason ( virus , hacking, software bug or 
the like) this will be removed automatically on power cycling (turning the 
PC. . . 

...would connect to the Internet through a selected partition. HARDWALL 
would not prevent a malicious program or virus or a hacker from gaining 
access to the selected partition but totally protects the rest of the 
system and warns the user of any attempts to illegally cross partition 
boundaries. With regard to virus attack, HARDWALL is indifferent to the 
nature of the virus and simply protects the user's system from corruption 
by isolating the virus to the partition where it was introduced. Although 
no updates are required for the operating of HARDWALL, the supplied 
software includes Symantec Norton Antivirus Scanner for use in the selected 
partition should a virus be detected . Partitioning is effected by the 
inclusion in the installation of PartitionMagic Lite from PowerQuest. 
HARDWALL plugs into... 

...or EIDE interface hard disk drives and runs under Windows* 3.x, 1 95 and 
NT 4.0 operating systems . Peter Barlow, Director and General Manager 
of Vircon said: "There are over 16,000 known computer viruses and that 
number. . . 

...for every computer user. HARDWALL is a unigue hardware approach to 
overcoming the enormous combined threats of virus attack, hacking and the 
corruption of system configurations, which face companies and home users 
alike. So far. . . 



26/3, K/16 (Item 4 from file: 636) 

DIALOG (R) File 636:Gale Group Newsletter DB(TM) 
(c) 2003 The Gale Group. All rts. reserv. 

02964222 Supplier Number: 46038690 (USE FORMAT 7 FOR FULLTEXT) 
ANTI VIRUS: CHEYENNE SHIPS INOCULAN 1.01 FOR WINDOWS NT SERVERS & 

WORKSTATION; INDUSTRY'S FIRST REAL-TIME VIRUS SCANNING FOR WINDOWS NT 

EDGE: Work-Group Computing Report, pN/A 
Jan 1, 1996 

Language: English Record Type: Fulltext 



1 Document Type: Newsletter; Trade 
Word Count : 54 4 

scanner that detects nearly all known viruses as certified by the 
National Software Testing Laboratories (NSTL) . 

InocuLAN detects , identifies and cures — boot, file, multipartite, 
stealth, polymorphic, and macro viruses. When a virus is detected / 
InocuLAN notifies the user immediately, as well as sends an alert via 
Microsoft Mail, alphanumeric pager, SNMP, network broadcast, fax, or 
printed trouble ticket. InocuLAN maintains a detailed activity log of all 
virus scans across the network. The product also records to the windows 
NT system event log . 

InocuLAN 1.01 for Windows NT is unique in that it allows 
administrators to manage an entire... 
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...many new features including a possible security 'back door 1 in its 
Registration Wizard. The Registration Wizard allows Windows 95 users to 

register their programs with Microsoft online. However, the registration 
program apparently permits Microsoft to interrogate a user's computer 
environment, yielding to the Redmond, Washington based firm, information on 
what PC applications. . . 

...himself or his company identified, conceded that while many online 
service providers do the same thing when registering their clients, the 
Windows 95 Registration Wizard is -significantly more sophisticated in 
the way it gathers file information". He stated that while Microsoft was 
primarily interested in identifying pirated copies of its software on 
users 1 systems, such a security hole could permit abusive browsing of... 

. .-.aware of the strength of the Wizard file management capabilities since 
-they [Microsoft] could be using unpublished Application Program 
Interfaces (APIs)", unknown to even the most seasoned Windows user. One 
''knowledgeable software expert confirmed that the... 

...five-hour period. While loading the 13 diskettes comprising Windows 95, 
Wilson's computer repeatedly failed to recognize the second diskette. 
When loading the CD version of the Windows upgrade program, Wilson reported 
that his . . . 



26/3, K/18 (Item 6 from file: 636) 

DIALOG ( R) File 636:Gale Group Newsletter DB(TM) 
(c) 2003 The Gale Group. All rts. reserv. 

01130542 Supplier Number: 40884141 (USE FORMAT 7 FOR FULLTEXT) 
TECHNICAL EVALUATION - DR SOLOMON'S ANTI-VIRUS TOOLKIT 

Computer Fraud & Security Bulletin, vll, nlO, pN/A 
August, 198 9 

Language: English Record Type: Fulltext 
Document Type: Newsletter; Trade 
Word Count: 2777 



{USE FORMAT 7 FOR FULLTEXT) 



'TEXT : 

...past year, even to the extent of reports being run on television news. 
In essence a computer virus is only a computer program , but it has 
the distinguishing feature that it is capable of replicating itself, and 
transforming from one disk to another. If a virus gets in to your 
computer system, it can proliferate and cause problems with the operation 
of the. . . 

...malicious side-effects. Much effort, and endless hours of discussion, 
have been devoted to the problem of detecting and eradicating computer 
viruses. The stated aim of the anti- virus toolkit is to provide accurate 
information about the viruses that are currently around, details of how 
they work, and a set of computer programs (tools) useful for dealing 
with the virus problem. It is published by Alan Solomon who has kept a 
very high profile in the UK with regard to computer virus infections. In 
the UK you would have to have been either a monk or a troglodyte over. . . 

...users purchase a valid copy by explaining that any pirate copy may 
itself be infected with a virus , hence the quote: "Don't put your data at 
risk, buy a legal copy of this software... 

...disk. This is essential when you are dealing with viruses which can 
corrupt programs and/or the operating system by altering the disk 
resident copies of such information. The software in the toolkit splits 
into three . . . "~ • 

...which help the user to manipulate disks and/or files, and programs that 
try to prevent a virus taking action. There is no space to go into all of 
these programs in detail, consequently I... 

...weaknesses. First the programs that locate and eradicate viruses. These 
are the best part of the anti- virus toolbox. The program called FINDVIRUS 
looks for known virus signatures' by comparing files for sequences of 
bytes known to exist in current viruses. It has the... 

...and insurmountable) limitation that it can only check for viruses that 
are known to exist. Any new virus will not be detected until this 
program has been upgraded. FINDVIRUS knows when it is dealing with a floppy 
disk, and. . . 

...half full, this corresponds to a checking rate of 30 Kbytes per second. 
If you get a virus infection and therefore need to check every floppy 
disk in the company (yes, you must check every. . . 

...indicate what a mammoth task this can be. The method of checking for 
files altered by a virus (CHKVIRUS) actually comprises three programs 
-SHERLOCK, HOLMES and WATSON. Respectively these calculate a set of 
fingerprints 1 (checksums) for a specified list of files, detect any 
changes in the files specified in this list by checking the fingerprints, 
and create the list of files to be checked. My first attempt at running 
SHERLOCK produced the error message "Can't... 

...handling is needed. My initial attempts at running WATSON fared even 
worse. This program should create a list of files in a form suitable for 
reading by the program SHERLOCK, which then calculates theirf ingerprints . 
The . . . 

...fingerprints remains a secret known only to Alan Solomon. To prevent 
reverse engineering by a particularly clever virus , this algorithm should 
be cryptographically strong. If it is not, it may be possible to deduce the 
...Be warned. One of the programs is used solely to execute other programs. 
If you think a virus is present which infects files, then using this 
program every time another program is executed provides a... 

...version of a Sacrificial Goat 1 . If the executable image of a program 
stored on disk changes, a virus infection may be tfie cause. Once you know 
this, and can pinpoint the infection, other tools can- • . 

...to provide further information. I like this idea, it seems a useful way 
of persuading a dormant virus to attack a known target file. The program 



"TRYOUT attempts to write to the boot sector of. 



...the manual, the last method is kept secret. This program can be used to 
test how well virus prevention programs from other vendors work (or 
don't) . The documentation accompanying TRYOUT in the manual claims that all 
of the anti- virus programs so far tested have failed this test. However 
no details are given, which relates the comments... 

...a disk against specified viruses. Many viruses inspect a disk to see if 
a copy of the virus is already present before they replicate themselves 
and infect the disk. If they did not do this... 

...infected to such an extent that the system became unusable. Such a 
strategy does not help the virus to survive. Inoculation programs are 
provided against the following viruses : Brain, Italian, Stoned, 64 8, 1813, 
1701, 1704... 

...latter ones are named after the amount they increase the size of an 
infected file) . On a virus -free disk, an inoculation program writes the 
byte sequence which the virus tests to see if the disk is already 
infected. If the disk appears to be already infected, the virus does not 
try to infect the disk again. The analogy with inoculation against a 
biological virus is obvious. I have not commented on the programs that 
attempt to facilitate inspection of a disk. . . 



...difference between Trojan Horses, logic bombs, time bombs and viruses : 
all of which are examples of malicious computer programs . The toolkit 
even contains a copy of a well known file called "The Dirty Dozen". This is 
regularly updated, and contains a list of the names of currently known 
malicious programs, together with a short description of their known effect 

...the manual which describes what to do if you think that some of your 
computers have a virus infection. The main thing to do is also the 
hardest thing to do, precisely nothing. This prevents... 

...I wholeheartedly agree with Alan Solomon's statement that "More damage 
is done by panic than the virus ". The first thing to do is to spend a few 
days thinking about the problem. The virus has probably been there for 
some while, and a couple more days won't make any difference, but a decent 
strategy may prevent further problems caused by panic measures. Don't buy 
the anti- virus toolkit if you don't have an ...The programs are only 
relevant to computers running one of the many versions of the MS-DOS 
operating system , and the information contained in the manual on viruses 
for other computers is admittedly second hand. Some... 

...not mandatory. This point is particularly relevant in discussion of 
viruses, as one way in which a virus can attach itself to another program 
is to point this jump statement at its own code, do. . . 

...one reason why viruses are sometimes unpredictable in their actions. The 
toolkit manual states that every file virus known to be in circulation 
resets the date and time on an affected file to its original value (section 
2.3). It then contradicts itself by stating that the Lehigh virus does 
not reset the date of COMMAND.COM when it alters this file. On the whole 
the manual contains sensible advice, if populated with multitudinous plugs 
for Alan Solomon's services as a virus exterminator. The advice is 
somewhat obscured by jargon introduced somewhat unnecessarily e.g. IAFV 
(Indirect Action File Virus ) . I don't believe that such grandiose names 
help anybody . . This is especially true when the manual does not contain a 
glossary explaining such terms. On a similar theme, neither does it contain 
an index , so looking for a particular item is only possible by digging 
around likely sections listed in the... 

...a whole chapter dedicated to the computer viruses known to operate on 
PCs (nine in total). Each virus merits about a page of explanation. This 
is the strong point of the manual, and the explanations are very detailed. 
Nobody can work in ignorance, and knowing the symptoms of a virus can 
help enormously. The amount of work done on viruses shines through in this 



'part of the . . - 

...reboot. Nasty. The remedy is to always use the mains power switch to 
cause a reboot, no virus can survive that. I ! m unhappy about the 
justification used to steer potential users away from utilities. . . 

...clear concise functions. Such remarks seem to be merely a marketing 
ploy. Should you buy the anti- virus toolkit? On the down-side I'm unsure 
that inoculating disks against a possible future virus infection is a 
good tactic. Inoculation is by its very nature virus specific, and could 
conceivably cause problems. There are many loose ends in the programs 
provided in the toolkit, the error handling is abysmal, and some of the 
virus specific features can be obtained for free from programs placed in 
the public domain by their authors... 

...who have had to fight infections of specific viruses. However if you 
think you may have a virus , the explanations of what to do are excellent, 
the virus specific portions of the toolkit seem comprehensive, and at 
UK4 9 you can't go far wrong price... 

...the utility programs such as Norton and PC-Tools. They offer much more 
functionality than the anti- virus toolkit for inspecting disks, and when 
combined with the virus specific sections of the toolkit offer what is 
probably one of the best combinations currently available to fight a 
computer virus infect ion". ~ " 
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TEXT: 

... WorldSecure Server or IBM's SecureWay FirstSecure. 

FirstSecure, which shipped in March, includes IBM's eNetwork firewall, 
virus -checking tools from Network Associates Inc., content-filtering 
software from Content Technologies Inc., authentication technology from 
Security Dynamics Technologies Inc. and a policy management tool called 
Policy Director . FirstSecure runs on Windows NT and IBM's AIX and 
costs $91 per user with volume discounts. 
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Captioned as: WEBMASTER... 
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* TEXT : 

A French Internet worm called PrettyPark, which infected thousands of 
Microsoft Windows users last week, can download company data used by. . . 

...telecommuters often fail to regularly update their antivirus software, 
said Sal Viveros, group marketing manager for total virus defense at 
Network Associates Inc. (NAI) in Santa Clara, Calif. "As more and more 
people telecommute, that. . . 

...break down a firewall," Viveros said. Trojan TerrorPrettyPark, for 
example, enters a user's system as a Trojan horse when Windows users 
open an attached e-mail file named PrettyPark. Unknown to users, the worm 
connects their PC to a custom IRC channel when they are logged on to a 
remote server. . . 

...the creator of the custom channel or his robot program can download the 
victim's files, passwords, log -in data, operating system preferences 
and other personal information — including stored credit-card 
numbers . PrettyPark also sends duplicate files of itself... 

...addresses listed in the user's Internet address book. Antivirus softwar 
firms say they're trying to determine who's collecting this 
information. The worm has mostly attacked home users who are less likely 
to update antivirus software or use firewalls that... 

...June 10]," said Nachenburg, whose company (www.symantec.com) distribute 
Norton Antivirus software, which also blocks the worm . w 
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further 
destruction 

HALIFAX, N.S., June 10 /PRN-CNW/ - FastLane Technologies Inc., a 
leading developer of enterprise Windows NT Directory Management 
solutions, today released an application to detect and disable the 
Trojan Horse e-mail virus { worm ) termed Worm .ExploreZip. The 
application is available as a free download from the FastLane web site at 
www.fastlanetech.com/ worm 
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Windows 2000 Professional. The Index Server provides local content 



indexing as a background service, like a Web worm for your hard driv^ . 
You determine what directories it will index and the basic properties of 
files it will track. Switching this service. . . 
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... system. This category includes: Operating-system agents, which can 

monitor almost every aspect of a machine's operating system ; log 
agents, which can monitor events and alerts logged to a file or log 
system by the operating system and applications running on it; process 
agents, which monitor the activity of specific applications or system 
processes running within the operating system; and script agents, which can 

run scripts and executable programs - on- a~syst em. ; Script agents can ~be 

used in conjunction with any of the other system agents... 
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... NT is the only virus protection product currently available for 

Windows NT servers. The product offers good detection and is easy to use, 
but several areas need some work. Unified Front: InocuLAN f s BackOffice 
certification means that the product supports unified Windows NT log 
-ins, runs as a service, and can be remotely deployed through SMS. 
Corporate Scoreboard: InocuLAN 1.01... 
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... s Windows (r) 95-like interface is a state of the art, 

heuristic-based, polymorphic scanner that detects nearly all known 
viruses as certified by the National Software Testing Laboratories (NSTL) . 
InocuLAN detects , identifies and cures — boot, file, multipartite, 
stealth, polymorphic, and macro viruses. When a virus is detected , 
InocuLAN notifies the user immediately, as well as sends an alert via 



Microsoft Mail, alphanumeric pager, SNMP, network broadcast, fax, o r 
printed trouble ticket. InocuLAN maintains a detailed activity log of all 
virus scans across the network. The product also records to the Windows 
NT system event log . 

InocuLAN 1.01 for Windows NT is unique in that it allows 
administrators to manage an entire... 
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... many applications. Without support for NetWare 4.1, these products 

do not allow you to use NetWare Directory Services. 

Many Windows NT options, such as SNA gateways and tape backup 
systems, duplicate NetWare server functions. However, many NetWare 
NLMs-such as Internet gateways,- most- accounting software, imaging -systems, 
management and control programs, and virus detection -either do not 
exist for Windows NT or have a single supplier. Further, many NetWare 
applications require... 
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processing, and workflow productivity applications. 
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operations (opening files, finding files, etc.). 

Dynamic heuristic virus detection can detect many different 
permutations of a given operation more easily than the static heuristic 
method. . . 



.an interrupt is called during the emulation, the dynamic heuristic 
antivirus program checks the values in the registers . These values 
specify the task that the target program wants the operating system 
to perform on its behalf. As discussed above regarding static heuristics, 
a virus infecting the target program may choose to put certain values 
in the registers in a great variety of ways. However, when the 
interrupt is finally called, the registers must contain the certain 
values that correspond to the desired operation. A dynamic heuristic 
antivirus program is only concerned with the values of the registers at 
the time of the interrupt call. 

While the dynamic heuristic technique is superior in detecting virus... 
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...SPECIFICATION system management mechanisms only recognize events that 
are generated from a dedicated hardware signal to an event register 
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to create system or wake up events when the devices do not... 

...in response to another event such as a legacy IRQ. The above described 
computer system hardware and computer program methods are exemplary 
of this invention. However, the invention is not limited to these 
embodiments. For example, the computer program routines illustrated 
in Figs. 3 and 4A-C may include other functionality in addition to that 
necessary for creating an operating system recognizable event in 
response to a legacy event. Further more, the computer system hardware is 
not limited to. . . 
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...SPECIFICATION to data in a data file. 

It is noted that some viruses do not write with initialized index 
registers but knows the state of the register because the operating 
system may guarantee the state. One such virus is the PC Weevil virus 

that uses an indexed memory write instruction to add zero to some 
locations which does not alter the value stored in... 
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...SPECIFICATION a number of functions, including data buffering, status 
indication and control and configuration functions. 

I/O-mapped registers are vulnerable to having their contents 
corrupted or undesirably altered in a number of ways. For example, a 
"berserk" or malfunctioning program, a virus program or even the 
operating system itself may attempt to alter the contents of an 
l/0-mapped register in an illegal manner. The corruption of the 
contents of an l/0-mapped register may have very serious consequences 
for the functioning of the computer system, and also for the physical... 

...of the computer system. This vulnerability is particularly serious when 
the contents of an I/O-mapped register , performing a control or 
configuration function, are modified. At the very least, corruption of 
the register contents may result in a software failure. In a worst case 
scenario, such as where the I/O-mapped register stores a value relating 
to power management, corruption of the contents of the register may 
cause the processor to over-heat and burn. This worst case scenario poses 
a considerable threat. . . 

...software, and even to the safety of a computer system user. The 

vulnerability of I/O-mapped registers also provides authors of virus 
programs with the opportunity to write virus programs which cause 
untold mischief and disruption within a computer system. 
Prior art methods of providing access... 

...whether the application program can validly access an I/O instruction. 
This protection mechanism generally allows the operating system , 
which has a privilege level of 0, and certain device drivers, which have 
privilege levels of 1... 

...drivers, which have a privilege level of 3. However, this protection 
mechanism is not effective against a virus program that manages to 
obtain a privilege level of 0, or against a poorly written device driver 
...above described arrangement provides a simple, yet effective, 



protection against malfunctioning programs, virus programs or even an 
operating system kernel which may otherwise have been able to access, 
and illegally modify, the contents of the registers 60, The secure 
protection afforded to the registers 60 as described above is 
particularly valuable when any one of the registers 60.1 to 60.3 is 
used for power management and system configuration purposes, as 
corruption of data stored in such a register could have serious 
implications for the integrity of data, software arid even physical 
devices within the computer ... of I/O-mapped register against 
malfunctioning and virus programs, as well as illegal accesses by the 
operating system . The present invention is also advantageous in that 
it allows for the creation of various depths or... 

...absolute, or the protection can merely extend to blocking write 
transactions to a protected I/O-mapped register . 

The invention may allow for the configuration of I/O-mapped registers 
for expanded functionality. For example. . . 
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or operating systems. The techniques employ a monitor daemon which is 
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which can be bound into application programs. A user process is made 
fault tolerant by registering it with the monitor daemon. The degree of 
fault tolerance can be controlled by means of the fault-tolerant library. 
Included in the fault-tolerant library are functions which define 
portions of a user process's memory as critical memory, which copy the 
critical memory to persistent storage, and which restore the critical 
memory from persistent storage. The monitor daemon monitors 
fault-tolerant processes, and when such a process hangs or crashes, the 
daemon restarts it. When the techniques are employed in a multi-node 
system, the monitor on each node monitors one other node in addition to 
the processes in its own node. In addition, the monitor may maintain 
copies of the state of fault- tolerant processes running at least on the 
monitored node. When the monitored node fails, the monitor starts the 
processes from the monitored node for which the monitor has state on its 
own node. When a node leaves or rejoins the system, the relationship 
between monitored and monitoring nodes is automatically reconfigured. 
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.SPECIFICATION in FIG. 2. 

4 Detailed Description of a Preferred Embodiment 

The standard set of components for software fault tolerance 
described herein include a monitor for providing automatic fault 
detection and restart facilities and a fault - tolerant library of 
programs which may be used by any application program . The following 
Detailed Description will first present an overview of the monitor/ 
termed herein the watchd daemon, or simply watchd and the fault 
tolerant library, termed herein libft, and of the manner in which they 
cooperate to permit application-level fault - tolerant computing and 
will then present details of their implementation in a preferred 
embodiment . 

5 Overview of watchd. . . 



.workstations running the same operating system, for example SUN OS 4.1, 
a version of the UNIX operating system (UNIX is a registered 
trademark of AT& T) . watchd is implemented using UNIX user processes 
and libft is implemented as... 
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A microprocessor is disclosed which has enhanced system management 
capabilities. The microprocessor includes circuitry for accessing 
external memory within a known address space. Circuitry is provided for 
programmably defining a range of addresses within the address space for 
use by system management routines. In the preferred embodiment, the 
system management memory is defined by a starting address and a block 
size. Further, upon receiving a system management interrupt, the 
microprocessor stores that processor status information which is always 
affected upon initiation of a system management routine; other 
information is stored, such that the time overhead associated with system 
management routine is minimized. Additional features that provide added 
functionality are: (a) an NMI ENABLE feature allows servicing NMIs during 
SMM operations; (b) an SMI LOCK feature prevents unauthorized access to 
SMM space or SMM routines, such as by hackers or viruses; (C) an I/O 
buffering feature allows I/O information (operand, size, and port 
address) facilitates transparent retries of I/O operations that result in 
a trap to an SMI routine, such as for power-up of peripherals; and (d) a 
software SMM instruction provides added flexibility in the use of SMM 
operations, (see image in original document) 
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An improved method and system for reducing the number of segment 
register loads that occur during the transfer of control from an 
application program to an operating system routine is provided. In 
preferred embodiments on an Intel 80386 processor, an application program 
and operating system kernel share a code segment address space and a data 
segment address space from 0 to 4G, During the execution of the 
application program, which executes in user mode, a page table is defined 
to prevent the application program from accessing pages which correspond 
to the address space of 2G to 4G. When the application program invokes a 
system routine, the system routine does not need to load the data segment 
register since the application program and the kernel share the same data 
segment. If an application program does load the data segment register 
with a selector other than the selector for the shared data segment, then 
when the kernel tries to access memory using the data segment register, 
an exception is generated. The exception handler restores the selector 
for the shared data segment into the data segment register and resumes 
execution of the instruction which caused the exception, (see image in 
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A method for executing trusted commands, in which a trusted command is 
first received from a user at a user terminal and parsed by untrusted 
code; then passed to a trusted computing base for execution. The trusted 
computing base displays to the user for confirmation some indication of 
what is to be done. Confirmation of the commands prevents unauthorized 
modification of the commands and increases system confidence. A randomly 
{or pseudo-randomly) generated process identifier is employed to verify 
the existence of a trusted path, (see image in original document) 

ABSTRACT WORD COUNT: 91 

NOTE: 

Figure number on first page: 1 



LEGAL STATUS (Type, Pub Date, Kind, Text) : 



000531 A2 Transfer of rights t-o new applicant: Compaq 
Computer Corporation (687792) 20555 S.H. 249 
Houston Texas 77070 US 
910828 A2 Published application (Alwith Search Report 

;A2without Search Report) 
030102 Bl Date of lapse of European Patent in a 
contracting state (Country, date) : GB 
20020214, 
011114 Bl Granted patent 

000719 A2 Title of invention (English) changed: 20000531 
001004 A2 Title of invention (German) changed: 20000817 
001004 A2 Title of invention (English) changed: 20000817 
001004 A2 Title of invention (French) changed: 20000817 
021106 Bl No opposition filed: 20020815 
911113 A2 Designated Contracting States (change) 
930421 A3 Separate publication of the European or 

International search report 
930825 A2 Date of filing of request for examination: 
930630 

970212 A2 Date of despatch of first examination report: 
961227 

991013 A2 Legal representative ( s ) changed 19990825 
LANGUAGE ( Publication, Procedural , Application ) : English; English; English 
FULLTEXT AVAILABILITY: 

Word Count 
1098 



Assignee: - ^ " 

Application : 
Lapse : 



Grant : 
Change : 
Change : 
Change : 
Change : 
Oppn None: 
Change : 

Search Report: 
Examination : 
Examination : 
Change : 



Available Text 
CLAIMS A 
CLAIMS B 
CLAIMS B 
CLAIMS B 
SPEC A 
SPEC B 



Language 
(English) 
(English) 
(German) 
(French) 
(English) 
(English) 



Update 
EPABF1 
200146 
200146 
200146 
EPABF1 
200146 



Total word count - document A 
Total word count - document B 
Total word count - documents A + 



1038 
1087 
1128 
10147 
11059 
11246 
14312 
25558 



INTERNATIONAL PATENT CLASS: G06F-001/00 ... 



. . . G06F-012/14 



...SPECIFICATION improving security in computer systems. 

US Patent 4,918,653 proposes a trusted-path mechanism for an operating 
system to inhibit Trojan - horse programs. By pressing a Secure 
Attention key (SAK) on a terminal keyboard, a user may create a... 



...the terminal and a trusted-shell portion of a trusted computing base 
{ TCB ) in a UNIX-type operating system . When a SAK signal is received 
by the host, the host terminates all processes in the terminal... 

...No. 4,751,669 proposes a videotext decoded apparatus which is used, 
inter alia, to provide easy log -on and log -off procedures for 
videotext users. Certain commands (i.e., log -out) require confirmation 
by the user before they will execute. 

U.S. Patent No. 4,677,546... 

...files using "wild card" designators (e.g., "DEL* . * 11 ) . Prior to executing 
the command, the program displays a list of the specific files matching 
the wild card designator that will be erased and asks for confirmation... 

...permits the user to confirm selectively the deletion of individual files 
matching the wild card designator. 

UNIX operating system (no specific reference document) . In many UNIX 
systems, a number of simple shell commands translate directly into... 



27/5, K/9 (Item 9 from file: 348) 

DIALOG (R) File 3 4 8 : EUROPEAN PATENTS • • • ■ 

(c) 2003 European Patent Office. All rts . reserv. 

00445949 

METHOD OF READING AND WRITING FILES ON NONERASABLE STORAGE MEDIA 
VERFAHREN ZUM LESEN UND SCHREIBEN VON DATEIEN AUF NICHTLOSCHBAREN 
SPEI CHERMED I EN 

PROCEDE DE LECTURE ET D'ECRITURE DE FICHIERS SUR DES SUPPORTS DE STOCKAGE 
NON EFFA ABLES 

PATENT ASSIGNEE: 

DREXLER TECHNOLOGY CORPORATION, (338413), 2557 Charleston Road, Mountain 
View, CA 94303, (US), (applicant designated states: DE; FR; GB; IT) 
INVENTOR: 

SCIUPAC, Luis, H., 528 Hubbard Avenue, Santa Clara, CA 95051, (US) 
LEGAL REPRESENTATIVE: 

Kahler, Kurt, Dipl.-Ing. etal (6167), Patentanwalte Kahler , Rack, Fiener 
et col., Vorderer Anger 268, 86899 Landsberg/Lech, (DE) 
PATENT (CC, No, Kind, Date): EP 462180 Al 911227 (Basic) 

EP 462180 Al 930331 
EP 462180 Bl 970924 
WO 9010906 900920 
APPLICATION (CC, No, Date) : EP 90904554 900223; WO 90US994 900223 
PRIORITY (CC, No, Date) : US 320020 890307 
DESIGNATED STATES: DE; FR; GB; IT 
INTERNATIONAL PATENT CLASS: G06F-012/02 

CITED PATENTS (WO A) : US 4287568 A; US 4298932 A; US 4382279 A; US 4394745 
A; US 4414644 A; US 4437155 A; US 4558176 A; US 4680736 A; US 4691299 A 

CITED REFERENCES (EP A) : 

No further relevant documents disclosed; 

NOTE: 

No A-document published by EPO 
LEGAL STATUS (Type, Pub Date, Kind, Text) : 



Application : 


911227 


Al 


Published application (Alwith 


Search Report 






;A2without Search Report) 




Examination : 


911227 


Al 


Date of filing of request for 
910912 


examination : 


Change : 


921104 


Al 


Representative (change) 


European search 


Search Report: 


930331 


Al 


Drawing up of a supplementary 
report: 930211 


Examination : 


950405 


Al 


Date of despatch of first examination report: 








950217 




Change : 


970507 


Al 


Representative (change) 




Grant : 


970924 


Bl 


Granted patent 




Oppn None: 


980916 


Bl 


No opposition filed 





LANGUAGE ( Publication, Procedural , Application) : English; English; English 

FULLTEXT AVAILABILITY: 



Available Text 


Language 


Update 


Word ( 




CLAIMS B 


(English) 


9709W3 


1043 




CLAIMS B 


( German ) 


9709W3 


971 




CLAIMS B 


(French) 


9709W3 


1288 




SPEC B 


(English) 


9709W3 


4635 


Total 


word count 


- document 


A 


0 


Total 


word count 


- document 


B 


7937 


Total 


word count 


- documents A + B 


7937 



INTERNATIONAL PATENT CLASS: G06F-012/02 

...SPECIFICATION details of file management. 

Device drivers for magnetic storage devices access and update file 
allocation tables and directories , as well as data, on the storage 
medium several times during the execution of a single command for the 
operating system . This is done to maximize the performance of the 
disk, allowing more efficient retrieval the next time... 

. . . direct-read-after-write media, are nonerasable. These media are 
therefore often called write-once read-many ( WORM ) media, or just 
write-once media. Since write-once media are not erasable, each time a 

file is updated, capacity is lost. Multiple recordings of file allocation 

tables and directories during a single command are especially 
troublesome, as capacity is exhausted up to three times faster than. . . 



27/5,K/10 (Item 10 from file: 348) 

DIALOG (R) File 34 8: EUROPEAN PATENTS 

(c) 2003 European Patent Office. All rts . reserv. 

00318479 

Method of operating a multi -processor system for the transfer of data 

between processor units. 
Verfahren zur Bedienung einer Mehrprozessoranordnung zur Datenubertragung 

zwischen Prozessoreinheiten. 
Procede de commande d'un systeme multiprocesseur pour le transfert de 

donnees entre unites de traitement. 
PATENT ASSIGNEE: 

International Business Machines Corporation, (200120), Old Orchard Road, 
Armonk, N.Y. 10504, (US), (applicant designated states: DE; FR; GB) 

INVENTOR: 

Blount, Marion Lee, 554 Eleanor Drive, Mahopac New York 10541, (US) 
Morgan, Stephen Paul, 9617 Great Hill Trail No. 221, Austin Texas 78759, 

(US) 

Rader, Katalin Anna Veronika, 4903B Smokey Valley, Austin Texas 78731, 

(US) 

LEGAL REPRESENTATIVE: 

Bailey, Geoffrey Alan (27921), IBM United Kingdom Limited Intellectual 
Property Department Hursley Park, Winchester Hampshire S021 2JN, (GB) 
PATENT (CC, No, Kind, Date): EP 319148 A2 890607 (Basic) 

EP 319148 A3 900711 
EP 319148 Bl 940216 
APPLICATION (CC, No, Date) : EP 88310567 881110; 
PRIORITY (CC, No, Date) : US 127000 871130 
DESIGNATED STATES: DE; FR; GB 

INTERNATIONAL PATENT CLASS: G06F-015/16 ; G06F-012/08 

CITED PATENTS ( EP A) : EP 211420 A; EP 81056 A 
CITED REFERENCES (EP A) : 

PROCEEDINGS OF THE NATIONAL ELECTRONICS CONFERENCE, vol. 37, 1983, pages 
309-315, Oak Brook, Illinois, US; A. BETTENCOURT et al - : "NET - A new 
unix* based transparent networking system" 
IDEM 

K. HWANG et al.: "Computer architecture and parallel processing", 1984, 
pages 492-502, McGraw-Hill Book Co., US; 
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A method for minimising I/O mechanical assess operations on secondary 
storage devices in a data processing system having a plurality of 
processor units interconnected in a cluster configuration to permit each 
processor unit to request and obtain data that is resident only on a 
secondary storage device of one processor unit. The method involves the 
steps of maintaining at each processor unit information about each copy 
of data that has been sent from the unit to another unit to permit a 
second request to the unit to be serviced by transferring a copy of the 
data from the main memory which is storing the data to the requesting 
unit rather than servicing the request with a relatively slow I/O 
accessing operation to a secondary storage device. 
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opened on behalf of an application program executing on processing 
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In Step G, upon receipt of message 1 from processing unit 10a , 
processing ... segment SL containing file F. 

In Step B the application program page faults. In Step C the operating 
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...determines that it was caused by a read access to page P of segment SA 
by the application program . 

In Step D processing unit 10a determines that segment SA is a local 
segment bound to remote... 



27/5,K/ll 



(Item 11 from file: 348) 



DIALOG ( R) File 34 8: EUROPEAN PATENTS 

(c) 2003 European Patent Office. All rts . reserv. 



00318440 

Method of operating a multiprocessor system employing a shared, virtual 
memory . 

Verfahren zum Betreiben eines einen anteilig genutzten virtuellen Speicher 

verwendenden Mul t ipr ozess or sys terns . 
Procede pour actionner un systeme a multiprocesseur employant une memoire 

virtuelle commune . 

PATENT ASSIGNEE: 

International Business Machines Corporation, (200120), Old Orchard Road, 
Armonk, N.Y. 10504, (US), (applicant designated states: DE;FR;GB) 
INVENTOR: 

Blount, Marion Lee, 554 Eleanor Drive, Mahopac New York 10541, (US) 

Cocchi, Anthony, 45 Monroe Avenue, Larchmont New York 10538, (US) 

Mergen, Mark Frederick, Cliffside Lane, RFD 2, Mt. Kisco, New York 10549, 

(US) 

Morgan, Stephen Paul, 9617 Great Hills Trail, 221, Austin Texas 78759, 

(US) 

Rader, Katalin Anna, 4903B Smokey Valley, Austin Texas 78731, (US) 
LEGAL REPRESENTATIVE: 

Burt, Roger James, Dr. (52152), IBM United Kingdom Limited Intellectual 
Property.. Department. Hursley Park, Winchester Hampshire S021 2 JN, (GB) 
PATENT (CC, No, Kind, Date) : EP 323013 A2 890705 (Basic) 

EP 323013 A3 910320 
EP 323013 Bl 950830 
APPLICATION (CC, No, Date) : EP 88310528 881109; 
PRIORITY (CC, No, Date) : US 126820 871130 
DESIGNATED STATES: DE; FR; GB 
INTERNATIONAL PATENT CLASS: G06F-011/14 
CITED PATENTS (EP A) : US 4228496 A 

ABSTRACT EP 323013 A2 

A method for maintaining, the overall system availability of a 
multi-processor data processing system in the event of a failure at one 
of a plurality of independent failure points. The system includes a 
plurality of virtual memory type processor units, each of which includes 
an interactive terminal, and a main memory which is connected to a 
secondary storage device which is also shared by the main memory of one 
of the other processor units. The main memories of the two units are also 
interconnected to provide a shared virtual memory system. Both processor 
units employ the same operating system and share the same virtual address 
space for storing information. The interactive terminal of each processor 
unit is connected to the other processor unit. Failure points include the 
terminals, the processor units, the communication links, and the various 
software components that are employed by the system. System availability 
is maintained by managing the storage of selected information at 
pre-established precise points in the processing operation. Identical 
operating system data structures that are stored in each processor unit 
are updated with the results of certain identified data processing 
transactions which have affected information required for succeeding 
processing operations in manner to insure that either identical updates 
occur or no update occurs. The arrangement ensures that any changes that 
might have occurred in the. information stored in the data structure prior 
to the end of an aborted transaction is returned to the initial state to 
permit the transaction to be retried whenever the path of the failure can 
be bypassed. 
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that it contains an entry for M u" and that u is a 



di rectory . 

In Step D the - operating system examines -the -u — directory — for 

"smorgan" and determines that smorgan is a directory. 

In Step E the operating system examines the smorgan directory for 
"status" and determines that an entry for status does not exist. 

In Step F the operating system creates a cluster storage file 
identifier CSFID and cluster storage file descriptor CSFD for the file... 

..is a 7 bit integer that uniquely identifies a given processing unit 
within a cluster configuration. The operating system creates cluster 
storage file descriptor CSFD by using cluster storage file identifier 
CSFID to index into... 

. . smorgan/status contains cluster storage and has been created as a result 
of a call to open executed at processing unit 10a, processing unit 10a 
elects itself as the access coordinator for the file. 

In Step G the operating system uses the Create Segment Service (CSS) 
to create a virtual memory segment for the cluster storage. . . 

. . file identifier CSFID and the access coordinator processor identifier 
PID for the file. 

In Step J the operating system executing on processing unit 10a 
informs the application program executing on processing unit 10a 
that the file /u/smorgan/status has been created. 

Fig. 3 is a... that it contains an entry for "u" and that u is a 
directory. 

In Step D the operating system examines the u directory for 
"smorgan" and determines that smorgan is a directory. 

In Step E the operating system examines the smorgan directory for 
"status" and determines : 

(1) that status is a cluster storage file, 

(2) that status already exists, 

(3) that processing unit... 
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English Abstract 

An apparatus for logging data relating to a call from a program to a 
function library includes a mechanism for intercepting the call from the 
program, and a mechanism for storing the data relating to the intercepted 
call in a log file. The apparatus also includes a mechanism for 
transmitting the intercepted call to the- function- library . The program - - 
may be an application program and the library may be a dynamic link 
library. The data in the log file may include the name of the function 
and input parameters to the function. A text program may be executed to 
display the stored data on a display device. 

French Abstract 

L 1 invention concerne un appareil de journalisation de donnees relatives 
a un appel entre un programme et une bibliotheque de f onctions . Ledit 
appareil comprend un mecanisme d 1 interception de 1* appel provenant du 
programme, et un mecanisme de stockage des donnees relatives a l 1 appel 
intercepte. Le programme peut etre un programme d 1 application et la 
bibliotheque peut etre une bibliotheque de liens dynamiques . Les donnees 
faisant partie du fichier de journalisation peuvent comprendre le nom de 
la fonction et des parametres remis a la fonction. Un programme de texte 
peut etre execute pour afficher les donnees stockees sur un afficheur. 

Main International Patent Class: G06F-011/00 
Fulltext Availability: 
Detailed Description 

Detailed Description 

... part of the configuration utility 312. Information entered into the 
GUI 500 preferably is stored in the operating system registry 
(present in the Microsoft NTTM operating system) , which includes the 
operating system configuration and computer system 200... 

...to be logged, a "NAME OF EXECUTABLE TO LOG" field 504 for entering the 
name of the application program 304, and a "LOCATION OF LOG FILE" 
field 506 designating the name of the resulting log file 3 10 and a path 
statement identifying the intended storage location of the log file 310 
within the computer system 200. In preferred embodiments... 
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English Abstract 

A dynamic heuristic method for detecting computer viruses comprising 
three phases: a decryption phase, an exploration phase, and an evaluation 
phase. A purpose of the decryption phase is to emulate a sufficient 
number of instructions to allow an encrypted virus to decrypt its viral 
body. A purpose of the exploration phase is to emulate at least once all 
sections of code within a region deemed likely to contain any virus 
present in the target program. A purpose of the evaluation phase is to 
analyze any suspicious behavior observed during the decryption and 
exploration phases to determine whether the. target appears to be _.. 
infected. 

French Abstract 

L ' invention concerne une methode heuristique dynamique permettant de 
detecter les virus inf ormatiques , cette methode se deroulant en trois 
phases: une phase de decryptage, une phase d ' exploration, et une phase 
d 1 evaluation . La phase de decryptage a pour but ^emulation d'un nombre 
d * instructions suffisant pour permettre a un virus crypte de decrypter le 
corps du virus. La phase d 1 exploration consiste a emuler au moins une 
fois toutes les sections d * un code a 1 ' interieur d'une region susceptible 
de renfermer un virus present dans le programme objet. Quant a la phase 
d ' evaluation, elle permet d 1 analyser tout comportement suspect observe 
pendant les phase de decryptage et d ' exploration, afin de determiner si 
ledit programme objet est infecte ou non. 

Main International Patent Class: G06F-011/00 
Fulltext Availability: 
Detailed Description 

Detailed Description 

the virus to decrypt before observing its virus-like operations 
(opening files, finding files, etc.). 

Dynamic heuristic virus detection can detect many different 
permutations of a given operation more easily than the static heuristic 
method. . . 

...is called during the 1 5 emulation, the dynamic heuristic antivirus 
program checks the values in the registers . These values specify the 
task that the target program wants the operating system to perform on 
its behalf As discussed above regarding static heuristics, a virus 
infecting the target program may choose to put certain values in the 
registers in a great variety of ways. However, when the interrupt is 
finally called, the registers must contain the certain values that 
correspond to the desired operation. A dynamic heuristic antivirus 
program is only concerned with the values of the registers at the time 
of the interrupt call. 

While the dynamic heuristic technique is superior in detecting virus... 
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English Abstract 

A secure communication platform on an integrated circuit is a highly 
integrated security processor which incorporates a general purpose 
digital signal processor (DSP) (62), along with a number of high 
performance cryptographic function elements, as well as a PCI and PCMCIA 
(14) interface. The secure- communications platform is integrated with an 
off-the-shelf DSP so that a vendor who is interested in digital signal 
processing could also receive built-in security functions which cooperate 
with the DSP. The integrated circuit includes a callable library of 
cryptographic commands and encryption algorithms. An encryption processor 
is included to perform key and data encryption, as well as a high 
performance hash processor and a public key accelerator (28) . 

French Abstract 

Une plate-forme de communications securisee sur un circuit integre 
constitue un processeur a securite integree comprenant un processeur de 
signal numerique polyvalent (DSP), plusieurs elements fonctionnels 
cryptographiques hautes performances, une interface PCI, et une interface 
PCMCIA. La plate-forme de communications securisee est integree a un 
processeur de signal numerique du commerce, de facon qu'un revendeur se 
preoccupant de traitement de signal numerique puisse egalement recevoir 
les fonctions de securite integree cooperant avec le processeur de signal 
numerique. Le circuit integre comporte une bibliotheque consultable de 
commandes cryptographiques et d 1 algorithmes de cryptage. L 1 invention 
concerne egalement un processeur de cryptage operant au niveau cle et 
donnees, ainsi qu'un processeur d ! adressage calcule hautes performances 
et un accelerateur a cle publique. 
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bit will be '0', as shown in the table below. Note that this Is al 
6-bit 

Register dress AD / WRITE) 

. . , =$ .... . . . 
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OxI 843 Not Visible Not Visible 
I P 

15 1... buffer, where the processed data is written back to the same 
location it came from. For most applications , the optimum transfer size 
is 256-bits (32 bytes) which provides the most 

52 

DES Modes 

The . . . MODE-S . /* unrecognized keyset type 

See Also: CGX-GEN-PL JBKEY, CGX-GEN-NEGKEY, CGX-SIGN, and 
CGX- VERIFY 

GEN NEGREY (Generate the DH Derived Secret Key) 
Command Name: CGX-GEN-NEGKEY 
GEN NEGKEY GXY 

219. . . 5 /*rangingf rom32-168bits (expressedinunitsof bytes ) . 
kb->cb->argument [5] = (VPTR) Ien; 

/* how this key will be used. By definition , the key will be 
/* untrusted, but the application must identify this as either 
/* a key encryption key (KEK) or a data encryption key (K) . 
kb->cb->argurnent. . .Decrypt command is used to decrypt the 
application's data using the RSA decryption algorithm, or to verify an 
RSA signature. Control over which operation is performed lies with 
the application. If the public key member of the key is NLTLL, an RSA 
decryption will be performed . If the private key member of the 
structure 

is NULL, a signature verification will be performed . The public 

keyset 

must be provided by the application and contain the private key portion 
of the ... extended algorithm block and enable kernel protection over the 
block . 

Once the extended algorithm block has been authenticated and 

loaded, the application can invoke operations in the extended algorithm 

block via the CGX- EXEC- EXTENDED command. When the 

application no longer needs... 

.loaded via the 
CGX-LOAD-EXTENDED command. 

Before invoking the extended algorithm block, the secure kernel 
will verify that the block is active {i.e., has a valid algorithm 
loaded) . If 

so, control is transferred. . . 



.the extended algorithm block via the 

block's entry point (the specific location is yet to be determined )• It 

is 

the algorithm block's responsibility to handle branching to the 
appropriate handler operation . In other words, once control is 
transferred to the ex-tended algorithm block's entry point, the... 
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English Abstract 

A method and apparatus for reverting a disk drive to an earlier point in 
time is disclosed. Changes made to the drive are saved in a circular 
history buffer which includes the old data, the time it was replaced by 
new data, and the original location of the data. The circular history 
buffer may also be implemented by saving new data elements into new 
locations and leaving the old data elements in their original locations. 
References to the new data elements are mapped to the new location. The 
disk drive is reverted to an earlier point in time by replacing the new 
data element with the original data elements retrieved from the history 
buffer, or in the case of the other embodiment, reads to the disk are 
mapped to the old data elements still stored in their original locations. 
The method and apparatus may be implemented as part of an operating 
system, or as a separate program, or in the controller for the disk 
drive. The method and apparatus are applicable to other forms of data 
storage as well. Also disclosed are method and apparatus for providing 
firewall protection to data in a data storage medium of a computer 
system. 



French Abstract 

L f invention se rapporte a un procede et a un dispositif permetta-nt de 
ramener une unite de disque a un point chronologiquement anterieur. Les 
modifications apportees a cette unite sont sauvegardees dans un tampon 
historique circulaire contenant les anciennes donnees, le moment auquel 
elles ont ete remplacees par de nouvelles donnees et 1 1 emplacement 
originel des donnees. Le tampon historique circulaire peut egalement etre 
mis en oeuvre grace a la sauvegarde de nouveaux elements de donnees dans 
de nouveaux emplacements et au maintien des anciens elements de donnees 
dans leurs emplacements originels. Des references relatives aux nouveaux 
elements de donnees sont appliquees au nouvel emplacement. L 1 unite de 
disque est ramenee a un point chronologiquement anterieur grace au 
remplacement des nouveaux elements de donnees par les elements de donnees 
originels recuperes dans le tampon historique ou bien, selon 1 ' autre mode 
de realisation, les anciens elements de donnees se trouvant toujours au 
niveau de leurs emplacements de memorisation originels sur le disque sont 
lus. Ce procede et ce dispositif peuvent etre mis en oeuvre sous forme 
d'une partie d'un systeme d ' exploitation, ou sous forme d'un programme 
separe, ou dans 1' unite de commande de 1' unite de disque. Ce procede et 
ce dispositif sont egalement applicables a d'autres formes de 
memorisation de donnees. L 1 invention concerne enfin un procede et un 
dispositif fournissant une protection de type filtrage aux donnees 
memorisees dans un support de memorisation de donnees d'un systeme 
info rmatique . - • • - - ' • — — • — 

Main International Patent Class: G06F-011/14 
Fulltext Availability: 
Claims 

Claim 

... 0 the period of time, and writing the recorded data as well as the 
current operating system ( OS ) visible image of the disk to another 
secondary storage medium, such that the medium can be used to recreate 
the disk's OS visible state at various points in time. 1 5 140. A 
method according to claim 138 wherein a directory is included on the 
secondary storage medium that optimizes sequential access to the data 
associated with a... 



27/5,K/24 (Item 13 from file: 349) 

DIALOG ( R) File 34 9:PCT FULLTEXT 

(c) 2003 WIPO/Univentio. All rts. reserv. 

00440493 **Image available** 
POLYMORPHIC VIRUS DETECTION MODULE 
MODULE DE DETECTION DE VIRUS POLYMORPHES 

Patent Applicant/Assignee: 

SYMANTEC CORPORATION, 
Inventor ( s ) : 

NACHENBERG Carey S, 
Patent and Priority Information (Country, Number, Date) : 

Patent: WO 9830957 A2 19980716 

Application: WO 98US8897 19980105 (PCT/WO US9808897) 

Priority Application: US 97780985 19970108 
Designated States: CA JP AT BE CH DE DK ES FI FR GB GR IE IT LU MC NL PT SE 
Main International Patent Class: G06F-011/00 
Publication Language: English 
Fulltext Availability: 

Detailed Description 

Claims 

Fulltext Word Count: 8524 
English Abstract 

A Polymorphic Anti-virus Module (PAM) (200) comprises a CPU emulator 
(210) for emulating the target program, a virus signature scanning module 
(250) for scanning decrypted virus code, and an emulation control module 
(220) , including a static exclusion module (230) , a dynamic exclusion 



module (240), instruction/interrupt usage profiles (224) for the mutation 
engines (162) of the known polymorphic viruses (150), size and target 
file types (226) for these, viruses , and a table (228) having an entry for 
each known polymorphic virus (150). During emulation, the emulation 
control module (220) may observe use of a register-indirect memory write 
instruction using a register that has not been initialized. Such a random 
write can be used as an indication that the file is probably a data file 
and so is unlikely to harbor a virus. 

French Abstract 

La presente invention concerne un module anti-virus polymorphe (PAM) 
(200) comportant un emulateur (210) d'unite centrale permettant d f emuler 
le programme cible, un module (250) de numerisation de la signature d'un 
virus permettant de numeriser une signature de virus decryptee, et un 
module (220) de commande de 1' emulation, comportant un module (230) 
d'exclusion statique; un module (240) d'exclusion dynamique; des donnees 
relatives aux profils (224) d 1 utilisation d 1 ins truction/interruption de 
programme pour les moteurs (162) de mutation des virus (150) polymorphes 
connus et aux dimensions et types (226) fichiers cibles de ces virus 
connus; et une table (228) dotee d'une d' entree pour chaque virus (150) 
polymorphe connu. Au cours de l f emulation, le module (220) de commande de 
l 1 emulation peut observer 1 ' utilisation d ! une instruction d'ecriture en 
memoire indirecte a registre au moyen d'un registre qui n'a pas ete 
initialise . Ces ecritures en memoire indexee et non initialisee peuvent 
etre utilisees pour indiquer que le fichier est probablement un fichier 
de donnees et que, par consequent, il n'est pas susceptible d'etre 
porteur d'un virus. 

Main International Patent Class: G06F-011/00 

Fulltext Availability: 
Detailed Description 

Detailed Description 
... in a data f ile . 

I 0 It is noted that some viruses do not write with initialized index 
registers but knows the state of the recrister because the operating 
system may guarantee the state. One such virus is the PC Weevil virus 

that uses an indexed memory write instruction to add zero to some 
locations which does not alter the value stored in. . . 
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English Abstract 

The parallel virtual directory system (12) can extend the native file 
system (8) to provide a superior method for organizing a computer 
system's physical storage devices or locations. These can include hard 
disks and removable media or remote storage locations such as on 
Internet. Interceptor modules (2) can monitor all files or memory changes 
such as creation, writes and deletes to the native file system and can 
pass this information to the parallel virtual directory system. The 
parallel virtual directory system may be accessed through the native file 
system methods allowing users to view their file system as it existed at 
any point of time, including removable media that is no longer present in 
the system. The parallel virtual file system may be implemented using 
database technology allowing multiple views of the file system for an 
easier navigation through it. Further, a set of management processes (3) 
can run at the application level providing data management services such 
as backup, archiving, and recording. — 

French Abstract 

Le systeme de repertoire virtuel parallele (12) de la presente invention 
permet de developper le systeme de fichiers natif (8) d ! un systeme 
informatique de maniere a en faire un outil perfectionne d 1 organisation 
des dispositifs ou emplacements de stockage physique dudit systeme. Ces 
dispositifs peuvent notamment etre des disques durs, des supports 
amovibles ou des emplacements eloignes, par exemple sur Internet. Des 
modules inter cepteurs (2) peuvent controler tous les changements de 
fichiers ou de memoires du type creation, ecritures et suppressions 
affectant le systeme de fichier natif et ils peuvent transmettre ces 
informations au systeme de repertoire virtuel parallele. On peut acceder 
a ce dernier en utilisant les procedes d f acces au systeme de fichiers 
natif qui permettent aux utilisateurs de visualiser leur systeme de 
fichiers tel qu'il se presentait a tout instant, et notamment les 
supports amovibles qui ne sont plus presents dans le systeme. Ledit 
systeme virtuel parallele peut etre mis en oeuvre au moyen d 1 une 
technologie de base de donnees autorisant de multiples vues du systeme de 
fichiers aux fins de simplification de la navigation. En outre, un 
ensemble de processus de gestion (3) peut tourner au niveau application 
pour assurer des services de gestion de donnees du type sauvegarde, 
archivage et enregis trement . 
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Claim 

... of the 

native directory; 

c) presenting on the single computer a virtual directory for use by the 
operating system , the virtual directory comprising at least a 
portion of the file attribute information for at least one of the files 

...virtual directory of files as described in claim 15 wherein the virtual 
directory is accessible by an application program . 17) The method of 
utilizing a virtual directory of files as described in claim 15 and 
further. . . 

...The method of utilizing a virtual directory of files as described in 
claim 17 and further comprising determining whether a storage medium is 
connected to the computer system. 19) The method of utilizing a virtual 



...as described in claim 15 and 

further comprising presenting a second virtual directory for use by the 

operating system. 47) The method of utilizing a virtual directory of 
files as described in claim 15 and... claim 15 and 
further comprising: 

entering a file name to be retrieved from the virtual directory; 

50 

determining which storage medium stores file data for the file name; 

and 

retrieving the file data. 52) The... 
.as described in 

claim 54 and further comprising: 

a means for scanning the native file directory to detect directory 
information of the native file directory to relay to the second file 
directory. 56) The apparatus... 

.as described in claim 54 and further comprising a means for monitoring 
I/O requests from an application program directed toward the native 
file directory. 58) The apparatus to update a file directory in a 
computer . . . 

.1 5 claim 54 and further comprising a means for monitoring for 1/0 
requests from the operating system of the computer system directed 
toward the native file directory. — 59 )~The" apparatus-to" update— a^ ~- — 
directory in a computer system as described in claim 54and further 
comprising a means for capturing an application program name that 
originates a file request command. 62) A method of updating a file 
di rectory in a . . . 

.computer system as described in 

claim 62 and further comprising monitoring for I/O requests from an 

application program directed toward the native file directory. 66) 
The method of updating a file directory in a computer system as described 
in claim 62 and further comprising monitoring for 1/0 requests from the 
operating system of the computer system directed toward the native file 
directory. 67) The method of updating a... 

.of updating a file directory in a computer system as described in claim 
68 and further comprising determining whether the storage medium has 
been connected to the computer system before. 70) The method of updating 
...in claim 62 and further comprising polling a physical storage devices 
which can house removable media to determine whether a piece of 
removable media has been installed. 74) The method of updating afile 
directory in. . . 

.75) The method of updating a file directory in a computer system as 
described in claim 62 detecting a media change message from a file 
system driver. 76) The method of updating a file directory in a computer 
system as described in 
claim 62 and further comprising: 

capturing an application program name that originates a file request. 

77) A computer system comprising: 

a) an accessible native file directory ... claim 95 wherein the virtual 
file directory and the second virtual file directory are accessible to an 

application program of the computer system. 97) The apparatus as 
described in claim 96 and further comprising a means... 

.in the database in a second 
virtual directory; and 

making the first virtual directory and second virtual directory 
accessible to the operating system of the computer system. 105) The 
method of utilizing a virtual file directory for a computer system. - - 

.a second 

virtual directory; and 

making the first virtual directory and second virtual directory 
accessible to an application program of the computer system. 106) The 



method of utilizing a virtual file directory for a computer system as 
described in claim 105 wherein the application program reconfigures 
the 

virtual file directory. 107) The method of utilizing a virtual file 
directory for a computer... 

...comprising presenting a native file directory in addition to the virtual 
file directory for use by an operating system of the 1 5 computer 
system. 109) The method of utilizing a virtual file directory for... 
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English Abstract 

A virus-resistant disk has a "hidden partition" in which anti-virus 
software is stored; the hidden partition not only shields the software 
from many viruses, but provides storage space that does not reduce the 
disk's formatted or advertised capacity. The disk includes software to 
cause the computer to execute the anti-virus software. The invention 
provides a hidden partition by utilizing storage space on the disk that 
is not reflected in the size and geometry information stored on the disk, 
e.g., in the BIOS Parameter Block. 

French Abstract 

La presente invention se rapporte a un disque resistant aux virus 
comportant une "partition cachee" dans laquelle un logiciel anti-virus 
est stocke; la partition cachee protege le logiciel non seulement contre 
de nombreux virus mais elle fournit egalement un espace de stockage ne 
reduisant pas la capacite formatee ou annoncee du disque. Le disque 
contient un logiciel permettant a 1 ' ordinateur d'executer le logiciel 
anti-virus. Le procede de 1' invention fournit une partition cachee en 
utilisant 1 1 espace de stockage sur le disque, ledit espace n 1 etant pas 
pris en compte dans les informations de taille et de geometrie stockees 
sur le disque, par exemple dans le bloc parametre BIOS. 
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... to files stored on the disk. The invention provides a virus-tolerant 
disk 3o that prevents an operating system from placing files in 
sectors that are known to be attacked by several viruses, thereby 
shielding the files from attack by the 



8 

viruses. An operating system uses a file system to manage storage 
space on a disk ...if it is the last cluster of the file, a 
"last-cluster" flag. The following Table 2 lists the relevant field of 
a FAT entry. A " directory " catalogs files stored on a disk. For each 
file, a directory stores the file's attributes, e.g., read-only, and 
correlates the file's name and extension to its first cluster number. 
Directories can be organized into a hierarchy starting at a "root" 
directory . The following Table 3 lists the 

relevant fields of a directory entry. Disk-maintenance software, such 

as 

CHKDSK, SCANDISK and SpinRite, uses well-known techniques to detect and 
repair damage to information, such as the FAT and directory , stored by 
the file system and to overcome recording errors, such as signals that 
are recorded of fcenter . . . 
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English Abstract 

The invention is a system for protecting the security of computer files. 
It has hardware elements, including a programmable auxiliary memory and 
control unit along with associated software elements. The security 
subsystem is installed on the host computer bus so that it resides in the 
control logic, address, and data signal path between the computer storage 
device and central processing unit. The security system is accessible by 
the computer operating system only during installation and 
initialization. Thereafter it is inaccessible to or by the operating 
system. Supervisor determined criteria for access permission to read, 
write and execute files are entered into the auxiliary memory system 
where they are protected from alteration. The security system will deny 
access to users with invalid entry criteria and refuse to write data to 
the file storage device when unauthorized operations have been performed. 
When breaches of these types occur the security system can lock the 
computer against further activity until it is released by entry of a 
master password from supervisory or security personnel. The system 
maintains a protected area in the computer memory device where, among 
other data, file signatures of all valid files are retained. The 
protected area of memory also maintains appropriate signatures of all 
internal files in the security system so that they can be automatically 
checked for integrity. 

French Abstract 

L' invention concerne un systeme de protection pour la securite des 
fichiers d ' ordinateur . II possede des elements machine, comprenant une 
unite de commande et memoire auxiliaire programmable ainsi que des 



elements de logiciel associes. Le sous-systeme de securite est installe 
sur le bus de l'ordinateur central de sorte qu f il reside dans le chemin 
de logique de commande, d'adresse et de signaux de donnees entre le 
dispositif de stockage de l'ordinateur et 1 1 unite de traitement centrale. 
Le sous-systeme de securite est accessible par le systeme de 
f onctionnement de l'ordinateur uniquement pendant 1 1 installation et la 
mise en marche. Ensuite, il est inaccessible au systeme de f onctionnement 
ou par ce systeme de f onctionnement . Des criteres determines par un 
superviseur pour 1 ' autorisation d 1 avoir acces au fichier, a leur lecture 
et a leur ecriture, sont entres dans le systeme a memoire auxiliaire ou 
ils sont proteges contre toute modification. Le systeme de securite 
refuse 1* acces a des utilisateurs dont les criteres d'entree ne sont pas 
valides et refuse l'ecriture de donnees dans le dispositif de stockage 
par fichier lorsque des operations non autorisees ont ete effectuees. 
Lorsque des infractions de ce type ont ete commises, le systeme de 
securite peut verrouiller l'ordinateur et empecher toute activite future 
jusqu'a sa liberation par introduction d'un mot de passe maitre introduit 
par le personnel de supervision ou de securite. Le systeme maintient une 
zone protegee dans le dispositif a memoire de l'ordinateur ou, parmi 
d'autres donnees, des signatures de fichiers de tous les fichiers valides 
sont retenues . La zone protegee de la memoire maintient egalement des 
signatures appropriees de tous les fichiers internes dans le systeme de 
securite de maniere a pouvoir controler automatiquement leur integrite. 
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... and should be common practice in most computer networks. But it does 
not prevent the problem of virus entry, . . .The most common use 
of this type of protection is found on computers based on the UNIX 

operating system . Unix is a trademark of AT&T Information Systems, 
New York, New York, for a linked multi... 

. . . available 

with an "unerase" feature. These take advantage of the way most files 
are removed from a directory by the operating system - The 
operating 

system simply indicates that the storage space of the deleted file is 
now available for new files, without actually physically erasing the 
earlier material. The unerase software restores the deleted file name 
back into the directory . However, it can function successfully only if 
the storage space occupied by the deleted file has not... 
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A method of inputting and outputting information files between a 
computer memory and a write-once medium in which a cache memory is 
established as an intermediary between an operating system's transfer 
address and the medium. The cache includes a system file allocation 
structure (Fig. 6) in a format corresponding to that for erasable media 
and a media directory file (Fig. 7). The directory in the write-once 
medium is read to the cache and the system file allocation structure 
(Fig. 6) is constructed from the directory information. When performing 
an operation system command, such as a read or write, access to the 
medium is made via the cache memory. For example, when reading a data 
file, sector locations indicated by the system file area (67) and the 
corresponding sectors are read from the medium (67). When writting a data 
file, sectors containing new data are identified, old sectors on the 
medium are marked, and only the new sectors are written to the medium 
with pointers linking them to the unchanged sectors. 

French Abstract 

Methode d' entree et de sortie de fichiers d 1 informations entre une 
memoire d'un ordinateur et un support a une seule ecriture ou une 
antememoire est etablie comme intermediaire entre l f adresse de transfert 
d f un systeme et le support. L 1 antememoire comprehd une structure 
d ! affectation de fichier (Fig. 6) dans un format correspondant a celui 
des supports effacables et un fichier repertoire du support (Fig. 7). Le 
repertoire dans le support a une seule ecriture est introduit dans 
1 1 antememoire et la structure d 1 affectation de fichier du systeme (Fig. 
6) est construite a partir des informations du repertoire. Lorsque 1 1 on 
effectue une commande dans le systeme, telle qu'une operation de lecture 
ou d' ecriture, l'acces au support s 1 effectue via 1 * antememoire. Par 
exemple, lorsqu'un fichier de donnees est lu, des emplacements de secteur 
indiques par la zone de fichier du systeme (67) et les secteurs 
correspondants sont lus depuis le support (67). Lors de l f ecriture d'un 
fichier de donnees, des secteurs contenant de nouvelles donnees sont 
identifiees, des vieux secteurs sur le support sont marques, et seuls les 
nouveaux secteurs sont ecrits sur le support, avec des pointeurs les 
associant aux secteurs inchanges . 
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. . . SUBSTITUTE SHE"ET 

Device drivers for magnetic storage devices ac 

cess and update file allocation tables and directories / 

as well as data, on the storage medium several times 
during the execution of a single command for the 

operating system , This is done to maximize the per 
forrnance of the disk, allowing more efficient retrieval 
the next . . . 

. . . read-af ter-write media, are noneras 

able, These media are therefore often called write-once 
read-many ( WORM ) media, or just write-once media, since 
write-once media are not erasable, each time a file is 
updated, capacity is lost, Multiple recordings of file 
allocation tables and directories during a single command 
are especially troublesome, as capacity is exhausted up 
to three times faster than. . . 



